SOAR4IoT: Securing IoT Assets with Digital Twins
SOAR4IoT: Securing IoT Assets with Digital Twins
复制标题
SOAR4IoT：利用数字孪生保护物联网资产
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
G. Pernul
中科院分区：
文献类型：
--
作者：
Philip Empl;Daniel Schlette;Daniel Zupfer;G. Pernul
随着越来越多的安全工具为组织提供网络安全功能，安全分析师被安全事件所淹没。由于大量的手动流程、有限的财务资源和人为错误，解决这些事件具有挑战性。安全管理、自动化和响应（SOAR）是管理安全工具和资产的既定方法。然而，SOAR平台通常只集成传统的IT系统。处理物联网（IoT）、其多个设备和复杂网络需要额外的考虑。因此，我们将SOAR应用于IoT。我们首先汇总了关于SOAR和SOAR平台的现有研究和信息。我们设想SOAR4IoT框架，通过中间件使物联网资产可为SOAR管理。我们实现了一个基于数字孪生的SOAR应用程序原型，该应用程序集成了物联网资产和安全工具，以验证我们的框架。实验设置包括应对米拉伊和西比尔攻击的两个剧本。结果显示了可行性，因为我们的SOAR应用程序可以通过数字孪生来保护物联网资产。
As more and more security tools provide organizations with cybersecurity capabilities, security analysts are overwhelmed by security events. Resolving these events is challenging due to extensive manual processes, limited financial resources, and human errors. Security Orchestration, Automation, and Response (SOAR) is an established approach to manage security tools and assets. However, SOAR platforms typically integrate traditional IT systems only. Additional considerations are required to deal with the Internet of Things (IoT), its multiple devices and complex networks. Therefore, we adapt SOAR to IoT. We first aggregate existing research and information on SOAR and SOAR platforms. We envision the SOAR4IoT framework, making IoT assets manageable for SOAR via middleware. We implement a prototypical digital twin-based SOAR application integrating IoT assets and security tools to validate our framework. The experimental setup includes two playbooks coping with Mirai and Sybil attacks. Results show feasibility as our SOAR application enables securing IoT assets with digital twins.