<4D F736F F F696E74202D DC6F4C3F7D0C7B3BDBAE8D1E3BCC6BBAEB4F0B1E75F BBCE6C8DDC4A3CABD5D>

Size: px

Start display at page:

Download "<4D F736F F F696E74202D DC6F4C3F7D0C7B3BDBAE8D1E3BCC6BBAEB4F0B1E75F BBCE6C8DDC4A3CABD5D>"

自相
5 years ago
Views:

1 针对主观攻击者的高级持续安全威胁博弈模型研究 2016 年度 CCF- 启明星辰鸿雁计划终验答辩院校 : 厦门大学通信工程系答辩人 : 肖亮教授

2 Contents P01 研究背景 P02 理论框架 P03 研究方法高级持续安全威胁的概念, 特点, 意图与攻击模型博弈论前景理论框架和累积前景理论框架基于前景理论, 演化博弈,CBG 和专家系统的 APT 防御机制

3 Part ONE 第一部分研究背景

4 Part ONE 高级持续安全威胁 (APT) 通过多个步骤入侵网络, 避免被检测以长期窃取有价值信息的攻击行为特点 : 目标明确持续性隐蔽性意图 : 窃取数据而非攻击网络 1

5 Part ONE APT 攻击模型攻击六阶段模型搜集目标系统情报采用恶意代码攻击目标系统利用命令与控制服务器控制目标系统在系统内部横向渗透攻击目标系统的资料发掘, 外传掩盖痕迹以长期访问目标系统 2

6 Part TWO 第二部分理论框架

7 Part TWO 博弈论博弈论是对 APT 威胁的环境来源和目标进行建模的重要数学工具现有研究假设攻击者完全理性, 选择令其期望收益最大的攻击策略攻击者追求信息或经济收益, 决策受主观影响 FlipIt 博弈模型 3

Part TWO Allais 悖论 High Probability 95% chance to win $10,000

$10,000 100% chance to win $501 0.05*10000<501 0.

lose $10,000 100% chance to lose $9,499 风险追求 0.

8 Part TWO Allais 悖论 High Probability 95% chance to win $10, % chance to win $9,499 风险规避 Low Probability 5% chance to win $10, % chance to win $ *10000< *10000>9499 Gain Lose High Probability 风险追求 95% chance to lose $10, % chance to lose $9,499 风险追求 0.95*10000>9499 Low Probability 5% chance to lose $10, % chance to lose $501 风险规避 0.05*10000<501 4

9 Part TWO 累积前景理论概率权重函数 : 描述主观的攻击者在选择攻击策略时, 过于重视小概率的损失, 忽视大概率的收益等特征价值函数 : 描述主观攻击者在选择攻击策略时的框架效应, 设置参考点衡量相对收益或损失 Subjective value Value Distortion Function =0.6, =0.6 =1, = Objective value 5

10 Part THREE 研究方法第三部分

11 Part THREE 基于前景理论的 APT 检测方案攻击持续时间和间隔未知研究攻击者主观度对动态纯 / 混合策略博弈的影响动态纯策略博弈平均攻击速率动态混合策略博弈平均攻击速率 D. Xu, Y. Li, L. Xiao, N. B. Mandayam, and H. V. Poor, "Prospect Theoretic Study of Cloud Storage Defense Against Advanced Persistent Threats,", in Proc. IEEE Global Communication Conference (GLOBECOM), Dec

12 Part THREE 基于前景理论的 APT 检测方案针对多存储设备, 多攻击持续时长的 APT 攻击模型在未知设备扫描间隔的情况下, 利用 Q 学习获得最佳的防御策略 L. Xiao, D. Xu, C. Xie, N. B. Mandayam, and H. V. Poor, "Cloud Storage Defense Against Advanced Persistent Threats: A Prospect Theoretic Study," IEEE Journal on Selected Areas in Communications, Mar 一种云存储系统的持续性攻击的检测方法, 中国, 发明专利, ,2017 年 5 月 3 日 7

13 Part THREE 基于累积前景理论的 APT 检测方案结合 APT 攻击的框架效应研究 APT 攻防方案引入累积前景理论研究多输出的系统模型 APT 检测博弈模型 NE 结果图 D. Xu, L. Xiao, N. B. Mandayam, H. V. Poor, "Cumulative Prospect Theoretic Study of a Cloud Storage Defense Game Against Advanced Persistent Threats," in Proc. IEEE International Conference on Computer Communications (INFOCOM WKSHPS), -BigSecurity, May

14 Part THREE 基于演化博弈论的 APT 防御机制利用演化博弈理论捕捉云端 APT 长期持续性的攻击行为利用演化稳定策略检测防御机制的纳什均衡能否抵抗轻微的扰动概率演化相位图 A. Abass, L. Xiao, N. B. Mandayam, and Z. Gaijic, "Evolutionary Game Theoretic Analysis of Advanced Persistent Threats Against Cloud Storage," IEEE Access, Apr

Part THREE 基于 CBG 的 APT 防御博弈动态云储存环境下获取检测 APT 攻击的最优检测资源分配防御系统选择用于安全检测的 CPU 资源个数 0.98 1 0.96 Data privacy level, R 0.94 0.92 0.9 0.88 0.86 PHC Greedy Random Data privacy level, R 0.95 0.9 0.85 0.

15 Part THREE 基于 CBG 的 APT 防御博弈动态云储存环境下获取检测 APT 攻击的最优检测资源分配防御系统选择用于安全检测的 CPU 资源个数 Data privacy level, R PHC Greedy Random Data privacy level, R PHC Greedy Random Time slot Total number of CPUs of the attacker, S N M. Min, L. Xiao, C. Xie, M. Hajimirsadeghi, N. B. Mandayam, "Defense Against Advanced Persistent Threats: A Colonel Blotto Game Approach," in Proc. IEEE International Conference on Communications (ICC), May

16 Part THREE 基于 CBG 的 APT 防御博弈研究在时变的数据存储模型下的 APT 攻击策略利用深度强化学习提高学习速率, 增强系统防御能力基于 DQN 的 APT 防御策略算法性能比较 M. Min, L. Xiao, C. Xie, M. Hajimirsadeghi, N. B. Mandayam, "Defense Against Advanced Persistent Threats in Dynamic Cloud Storage: A Colonel Blotto Game Approach", IEEE Internet of Things Journal, under review. 基于强化学习的检测高级持续威胁的资源调度方法, 中国, 发明专利, ,2017 年 8 月 11 日 11

Part THREE 基于专家系统的 APT 防御机制专家系统 : 监督系统, 根据虚警率和漏报率做出决策

with Expert System for Internet of Things, " in Proc.

17 Part THREE 基于专家系统的 APT 防御机制专家系统 : 监督系统, 根据虚警率和漏报率做出决策低 APT 攻击水平 APT 防御模型高 APT 攻击水平 Q. HU, S. Lv, Z. Shi, L. Sun and L. Xiao, " Defense Against Advanced Persistent Threats with Expert System for Internet of Things, " in Proc. IEEE/IFIP International Conference on Wireless Algorithms, Systems, and Application, June

18 Part THREE 论文专利发表情况 1. Cloud Storage Defense Against Advanced Persistent Threats: A Prospect Theoretic Study, IEEE Journal on Selected Areas in Communications, 35(3), Evolutionary Game Theoretic Analysis of Advanced Persistent Threats Against Cloud Storage, IEEE Access, 5, Physical-Layer Authentication Based on Extreme Learning Machine, IEEE Communication Letters, 35(3), Cloud-based Malware Detection Game for Mobile Device with Offloading, IEEE Transactions on Mobile Computing, 16(10), Attacker-Centric View of a Detection Game Against Advanced Persistent Threats, IEEE Transactions on Mobile Computing, under review 6. Defense Against Advanced Persistent Threats in Dynamic Cloud Storage: A Colonel Blotto Game Approach, IEEE Internet of Things Journal, under review 7. Two-Dimensional Anti-Jamming Communication Based on Deep Reinforcement Learning, IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Mar Game Theoretic Study of Protecting MIMO Transmission Against Smart Attacks, IEEE International Conference on Communications (ICC), May (Best paper award) 9. Phy-layer Authentication with Multiple Landmarks with Reduced Communication Overhead, IEEE International Conference on Communications (ICC), May

19 Part THREE 论文专利发表情况 10. Defense Against Advanced Persistent Threats: A Colonel Blotto Game Approach, IEEE International Conference on Communications (ICC), May Cumulative Prospect Theoretic Study of a Cloud Storage Defense Game Against Advanced Persistent Threats, IEEE International Conference on Computer Communications (INFOCOM WKSHPS), -BigSecurity, May FuzzyDP: Fuzzy-based Big Data Publising Aginst Inquiry Attacks, IEEE Conference on Computer Communication Workshops (INFOCOM WKSHPS), - MobiSec, May Energy Trading Game for Microgrids Using Reinforcement Learning, EAI International Conference on Game Theory for Network, May (Best paper award) 14. Defense Against Advanced Persistent Threats with Expert System for Internet of Things, IEEE/IFIP International Conference on Wireless Algorithms, Systems, and Application, June Reinforcement Learning Based Mobile Offloading for Cloud-based Malware Detection, IEEE Global Communication Conference (GLOBECOM), Dec Anti-Jamming Communication Game for UAV-aided VANETs, IEEE Global Communication Conference (GLOBECOM), Dec 一种云存储系统的持续性攻击的检测方法, 中国, 发明专利, ,2017 年 5 月 3 日 18. 基于强化学习的检测高级持续威胁的资源调度方法, 中国, 发明专利, ,2017 年 8 月 11 日 14

20 CCF-Venustech THANKS! 谢谢观看

Microsoft Word - 互联网物联网探索-讲习班.doc

Microsoft Word - 互联网物联网探索-讲习班.doc 中国计算机学会学科前沿讲习班 The CCF Advanced Disciplines Lectures 第 51 期互联网与物联网的新探索 2014 年 9 月 19-21 日上海本期 CCF 学科前沿讲习班互联网与物联网的新探索邀请到了互联网和物联网领域重量级的专家学