论文标题
网络攻击后果预测
Cyber-Attack Consequence Prediction
论文作者
论文摘要
网络物理系统认为由于处理，通信和功率功能有限的异质设备的互连而引起了许多安全挑战。此外，物理空间和网络空间的集合进一步使得很难制定跨越这两个空间的单个安全计划。网络安全研究人员通常每天都有多种网络掌握的人过载，其中许多事实证明是假阳性。在本文中，我们使用机器学习和自然语言处理技术来预测网络攻击的后果。这个想法是使安全研究人员能够拥有可以使用的工具，从而使与可能几乎没有网络安全专业知识的各种利益相关者进行攻击后果变得更加容易。此外，通过提出的方法，可以通过自动预测攻击的后果来减少研究人员的认知负担，以防新攻击。我们通过使用TF-IDF和DOC2VEC模型获得的单词向量的各种机器学习模型进行比较。在我们的实验中，使用TF-IDF特征获得了60％的精度，使用DOC2VEC方法获得基于线性模型的模型的57％。
Cyber-physical systems posit a complex number of security challenges due to interconnection of heterogeneous devices having limited processing, communication, and power capabilities. Additionally, the conglomeration of both physical and cyber-space further makes it difficult to devise a single security plan spanning both these spaces. Cyber-security researchers are often overloaded with a variety of cyber-alerts on a daily basis many of which turn out to be false positives. In this paper, we use machine learning and natural language processing techniques to predict the consequences of cyberattacks. The idea is to enable security researchers to have tools at their disposal that makes it easier to communicate the attack consequences with various stakeholders who may have little to no cybersecurity expertise. Additionally, with the proposed approach researchers' cognitive load can be reduced by automatically predicting the consequences of attacks in case new attacks are discovered. We compare the performance through various machine learning models employing word vectors obtained using both tf-idf and Doc2Vec models. In our experiments, an accuracy of 60% was obtained using tf-idf features and 57% using Doc2Vec method for models based on LinearSVC model.
