论文标题
在现实的基准中，基于知识的先进知识的先进持续威胁检测
Prior Knowledge based Advanced Persistent Threats Detection for IoT in a Realistic Benchmark
论文作者
论文摘要
被部署到网络中的物联网（IoT）设备的数量正在以惊人的水平增长，这使IoT网络在无线介质中更加脆弱。高级持续威胁（APT）对大多数网络设施都是恶意的，与正常流量相比，用于训练基于机器学习的入侵检测系统（IDS）的可用攻击数据受到限制。因此，增强检测性能以减轻APT的影响是非常具有挑战性的。因此，使用SCVIC-APT-2021数据集提出并测试了先验知识输入（PKI）模型。为了获得先验知识，提出的PKI模型使用无监督的聚类方法对原始数据集进行了分类。然后，将获得的先验知识纳入监督模型，以降低训练的复杂性并帮助监督模型确定原始数据和真实标签之间的最佳映射。实验发现表明，PKI模型的表现优于监督基线，最佳宏平均F1得分为81.37％，比基线高10.47％。
The number of Internet of Things (IoT) devices being deployed into networks is growing at a phenomenal level, which makes IoT networks more vulnerable in the wireless medium. Advanced Persistent Threat (APT) is malicious to most of the network facilities and the available attack data for training the machine learning-based Intrusion Detection System (IDS) is limited when compared to the normal traffic. Therefore, it is quite challenging to enhance the detection performance in order to mitigate the influence of APT. Therefore, Prior Knowledge Input (PKI) models are proposed and tested using the SCVIC-APT- 2021 dataset. To obtain prior knowledge, the proposed PKI model pre-classifies the original dataset with unsupervised clustering method. Then, the obtained prior knowledge is incorporated into the supervised model to decrease training complexity and assist the supervised model in determining the optimal mapping between the raw data and true labels. The experimental findings indicate that the PKI model outperforms the supervised baseline, with the best macro average F1-score of 81.37%, which is 10.47% higher than the baseline.
