Recent advancement in the complex attack model of the advanced persistent threats (APTs) has targeted the Industrial-IoT System which has presented a significant research issue in the cyber security domain. Most of the APTs detection framework experiences low detection accuracy due to lack of contextual information of the processes at the run time. This paper has proposed an efficient APTs detection framework for Industrial-IoT (IIoT) system by using the construction of provenance graph and performing the node embedding over the provenance graph using multi-layer Graph Attention Network architecture which capture complex relationships and behaviours within the system entities as contextual information. Finally, a stacking-based ensemble classifier is employed over the node embeddings for detection of APTs. Performance of the proposed framework is extensively evaluated and compared with the state-of-art modes using the DARPA E3 Theia APTs dataset. Experimental findings confirms that the proposed framework outshines the state-of-art models by observing the 99.92% precision, 99.88% recall, 99.90% F1-score and 0.01% FPR.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Advanced Persistent Threats Detection Framework for Industrial-IoT System Using Graph-Based Autoencoder and Stacking-Based Ensemble Technique

  • Avnish Ramvinay Singh,
  • Govind P. Gupta

摘要

Recent advancement in the complex attack model of the advanced persistent threats (APTs) has targeted the Industrial-IoT System which has presented a significant research issue in the cyber security domain. Most of the APTs detection framework experiences low detection accuracy due to lack of contextual information of the processes at the run time. This paper has proposed an efficient APTs detection framework for Industrial-IoT (IIoT) system by using the construction of provenance graph and performing the node embedding over the provenance graph using multi-layer Graph Attention Network architecture which capture complex relationships and behaviours within the system entities as contextual information. Finally, a stacking-based ensemble classifier is employed over the node embeddings for detection of APTs. Performance of the proposed framework is extensively evaluated and compared with the state-of-art modes using the DARPA E3 Theia APTs dataset. Experimental findings confirms that the proposed framework outshines the state-of-art models by observing the 99.92% precision, 99.88% recall, 99.90% F1-score and 0.01% FPR.