Sensors, Vol. 19, Pages 4045: Cyber Situation Comprehension for IoT Systems based on APT Alerts and Logs Correlation

Sensors, Vol. 19, Pages 4045: Cyber Situation Comprehension for IoT Systems based on APT Alerts and Logs Correlation
Sensors doi: 10.3390/s19184045
Authors:
Xiang Cheng
Jiale Zhang
Bing Chen

With the emergence of the Advanced Persistent Threat (APT) attacks, many Internet of Things (IoT) systems have faced large numbers of potential threats with the characteristics of concealment, permeability, and pertinence. However, existing methods and technologies cannot provide comprehensive and prompt recognition of latent APT attack activities in the IoT systems. To address this problem, we propose an APT Alerts and Logs Correlation Method, named APTALCM and a framework of deploying APTALCM on the IoT system, where an edge computing architecture was used to achieve cyber situation comprehension without too much data transmission cost. Specifically, we firstly present a cyber situation ontology for modeling the concepts and properties to formalize APT attack activities in the IoT systems. Then, we introduce a cyber situation instance similarity measurement method based on the SimRank mechanism for APT alerts and logs Correlation. Combining with instance similarity, we further propose an APT alert instances correlation method to reconstruct APT attack scenarios and an APT log instances correlation method to detect log instance communities. Through the coalescence of these methods, APTALCM can accomplish the cyber situation comprehension effectively by recognizing the APT att...

Source: Sensors - September 18, 2019 Category: Biotechnology Authors: Xiang Cheng Jiale Zhang Bing Chen Tags: Article Source Type: research