论文标题

物联网网络行为指纹指纹推断具有有限的网络跟踪进行网络调查:一种元学习方法

IoT Network Behavioral Fingerprint Inference with Limited Network Trace for Cyber Investigation: A Meta Learning Approach

论文作者

Pan, Jonathan

论文摘要

物联网(IoT)设备的开发和采用将在未来几年中显着增长,使行业4.0。许多形式的物联网设备将在行业垂直领域开发和使用。但是,这项技术采用的欣喜是由于将遵循其增长轨迹的网络威胁而庄严地存在。网络威胁要么将其恶意代码嵌入,要么在物联网中攻击漏洞,这可能会引起网络和物理领域的重大后果。为了管理这种破坏性效果,事件响应者和网络调查人员要求找到这些流氓物联网并迅速遏制它们的能力。这样的在线设备可能只会留下网络活动轨迹。相关痕迹的集合可用于推断物联网网络的行为指纹,进而可以促进这些物联网的调查发现。但是,挑战是如何在网络活动轨迹有限时推断这些指纹。这项研究提出了一种新型模型构造,该模型构造使用一个名为deepnetprint的单卡时间序列元学习器基于有限的网络活动痕迹来推断特定物联网的网络行为指纹。我们的研究还证明了DeepNetprint在识别与领先的监督学习模型相对较好表现的IoT设备方面的应用。我们的解决方案将使网络研究者能够确定感兴趣的特定物联网,同时克服仅具有有限的网络痕迹的限制。

The development and adoption of Internet of Things (IoT) devices will grow significantly in the coming years to enable Industry 4.0. Many forms of IoT devices will be developed and used across industry verticals. However, the euphoria of this technology adoption is shadowed by the solemn presence of cyber threats that will follow its growth trajectory. Cyber threats would either embed their malicious code or attack vulnerabilities in IoT that could induce significant consequences in cyber and physical realms. In order to manage such destructive effects, incident responders and cyber investigators require the capabilities to find these rogue IoT and contain them quickly. Such online devices may only leave network activity traces. A collection of relevant traces could be used to infer the IoT's network behaviorial fingerprints and in turn could facilitate investigative find of these IoT. However, the challenge is how to infer these fingerprints when there is limited network activity traces. This research proposes the novel model construct that learns to infer the network behaviorial fingerprint of specific IoT based on limited network activity traces using a One-Card Time Series Meta-Learner called DeepNetPrint. Our research also demonstrates the application of DeepNetPrint to identify IoT devices that performs comparatively well against leading supervised learning models. Our solution would enable cyber investigator to identify specific IoT of interest while overcoming the constraints of having only limited network traces of the IoT.

扫码加入交流群

加入微信交流群

微信交流群二维码

扫码加入学术交流群,获取更多资源