检索结果-内蒙古大学图书馆

28th International Conference on Knowledge Based and Intelligent information and Engineering Systems, KES 2024

作者： Rodda, Matthew Chambers, Alexander Rohl, Alexander Defence Science and Technology Group Department of Defence Australia

Visibility of network communications is critical for security analysts to understand, monitor, and secure computer systems. This visibility is difficult to achieve in the context of modern industrial control systems (ICSs) however, as these may contain a multitude of unique sensors, actuators, and controllers;each communicating via bespoke and diverse network protocols. We are the first to show that machine-learning algorithms, trained with logs of observable (and irregular) system events, can serve as accurate black-box network-monitoring tools for unknown protocols, and are robust to mislabelling and non-uniform timing lag. Using a newly-curated ICS analogue dataset, available here, we analyze a suite of classical and deep-learning models for an event-detection task, showing that decision trees can achieve F1macro = 99.9% with perfectly labeled training data, gradient-boosted decision-tree ensembles can achieve F1macro = 99.0% with mislabeled training data, and a 1D-CNN-LSTM architecture can achieve F1macro = 92.1% with non-uniform timing lag. We validate these techniques on existing ICS and operational technology datasets, achieving F1macro = 99.0%. Our results are a starting point for future work to enhance existing intrusion-detection systems and forensic analyses. © 2024 The Authors.

关键词： Deep Packet Inspection Event Detection network data classification

来源：评论

学校读者我要写书评

暂无评论

Robust Automated Event Detection from Machine-Learning Analysis of network data

引用

Procedia Computer Science 2024年 246卷 1619-1629页

作者： Matthew Rodda Alexander Chambers Alexander Rohl Defence Science and Technology Group Department of Defence Australia

Visibility of network communications is critical for security analysts to understand, monitor, and secure computer systems. This visibility is difficult to achieve in the context of modern industrial control systems (ICSs) however, as these may contain a multitude of unique sensors, actuators, and controllers; each communicating via bespoke and diverse network protocols. We are the first to show that machine-learning algorithms, trained with logs of observable (and irregular) system events, can serve as accurate black-box network-monitoring tools for unknown protocols, and are robust to mislabelling and non-uniform timing lag. Using a newly-curated ICS analogue dataset, available here , we analyze a suite of classical and deep-learning models for an event-detection task, showing that decision trees can achieve F 1 macro = 99.9% with perfectly labeled training data, gradient-boosted decision-tree ensembles can achieve F 1 macro = 99.0% with mislabeled training data, and a 1D-CNN-LSTM architecture can achieve F 1 macro = 92.1% with non-uniform timing lag. We validate these techniques on existing ICS and operational technology datasets, achieving F 1 macro = 99.0%. Our results are a starting point for future work to enhance existing intrusion-detection systems and forensic analyses.

关键词： Deep Packet Inspection Event Detection network data classification

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：