Predicting Consequences of Cyber-Attacks
Predicting Consequences of Cyber-Attacks
复制标题
DOI：
10.1109/bigdata50022.2020.9377825
复制
发表时间：
2020-12
期刊：
影响因子：
--
通讯作者：
Prerit Datta;Natalie R. Lodinger;A. Namin;Keith S. Jones
中科院分区：
文献类型：
--
作者：
Prerit Datta;Natalie R. Lodinger;A. Namin;Keith S. Jones
由于具有有限处理、通信和功率能力的异构设备的互连，网络物理系统面临着复杂的安全挑战。此外，物理空间和网络空间的聚集进一步使得很难制定一个跨越这两个空间的单一安全计划。网络安全研究人员每天都要处理大量的网络警报，其中许多都是误报。在本文中，我们使用机器学习和自然语言处理技术来预测网络攻击的后果。这个想法是为了让安全研究人员能够使用工具，以便更容易地与可能几乎没有网络安全专业知识的各种利益相关者沟通攻击后果。此外，使用所提出的方法，研究人员的认知负荷可以通过自动预测攻击的后果来减少，以防发现新的攻击。我们通过使用tf-idf和Doc 2 Vec模型获得的词向量的各种机器学习模型来比较性能。在我们的实验中，使用tf-idf特征获得了60%的准确率，使用Doc 2 Vec方法获得了57%的准确率。
Cyber-physical systems posit a complex number of security challenges due to interconnection of heterogeneous devices having limited processing, communication, and power capabilities. Additionally, the conglomeration of both physical and cyber-space further makes it difficult to devise a single security plan spanning both these spaces. Cyber-security researchers are often overloaded with a variety of cyber-alerts on a daily basis many of which turn out to be false positives. In this paper, we use machine learning and natural language processing techniques to predict the consequences of cyberattacks. The idea is to enable security researchers to have tools at their disposal that makes it easier to communicate the attack consequences with various stakeholders who may have little to no cybersecurity expertise. Additionally, with the proposed approach researchers’ cognitive load can be reduced by automatically predicting the consequences of attacks in case new attacks are discovered. We compare the performance through various machine learning models employing word vectors obtained using both tf-idf and Doc2Vec models. In our experiments, an accuracy of 60% was obtained using tf-idf features and 57% using Doc2Vec method for models based on LinearSVC model.