Zhang Shuqin, Bai Guangyao, Li Hong, Liu Peipei, Zhang Minzhi, Li Shujun
School of Computer Science, Zhongyuan University of Technology, Zhengzhou 450007, China.
Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China.
Sensors (Basel). 2021 Nov 15;21(22):7579. doi: 10.3390/s21227579.
Nowadays, there are different kinds of public knowledge bases for cyber security vulnerability and threat intelligence which can be used for IoT security threat analysis. However, the heterogeneity of these knowledge bases and the complexity of the IoT environments make network security situation awareness and threat assessment difficult. In this paper, we integrate vulnerabilities, weaknesses, affected platforms, tactics, attack techniques, and attack patterns into a coherent set of links. In addition, we propose an IoT security ontology model, namely, the IoT Security Threat Ontology (IoTSTO), to describe the elements of IoT security threats and design inference rules for threat analysis. This IoTSTO expands the current knowledge domain of cyber security ontology modeling. In the IoTSTO model, the proposed multi-source knowledge reasoning method can perform the following tasks: assess the threats of the IoT environment, automatically infer mitigations, and separate IoT nodes that are subject to specific threats. The method above provides support to security managers in their deployment of security solutions. This paper completes the association of current public knowledge bases for IoT security and solves the semantic heterogeneity of multi-source knowledge. In this paper, we reveal the scope of public knowledge bases and their interrelationships through the multi-source knowledge reasoning method for IoT security. In conclusion, the paper provides a unified, extensible, and reusable method for IoT security analysis and decision making.
如今，有不同种类的网络安全漏洞和威胁情报公共知识库可用于物联网安全威胁分析。然而，这些知识库的异质性以及物联网环境的复杂性使得网络安全态势感知和威胁评估变得困难。在本文中，我们将漏洞、弱点、受影响的平台、策略、攻击技术和攻击模式整合为一组连贯的链接。此外，我们提出了一种物联网安全本体模型，即物联网安全威胁本体（IoTSTO），以描述物联网安全威胁的要素并设计用于威胁分析的推理规则。这个IoTSTO扩展了当前网络安全本体建模的知识领域。在IoTSTO模型中，所提出的多源知识推理方法可以执行以下任务：评估物联网环境的威胁、自动推断缓解措施以及分离受到特定威胁的物联网节点。上述方法为安全管理人员部署安全解决方案提供了支持。本文完成了当前物联网安全公共知识库的关联，并解决了多源知识的语义异质性问题。在本文中，我们通过物联网安全的多源知识推理方法揭示了公共知识库的范围及其相互关系。总之，本文为物联网安全分析和决策提供了一种统一、可扩展且可重用的方法。
