Multi-Source Knowledge Reasoning for Data-Driven IoT Security

Abstract

Nowadays, there are different kinds of public knowledge bases for cyber security vulnerability and threat intelligence which can be used for IoT security threat analysis. However, the heterogeneity of these knowledge bases and the complexity of the IoT environments make network security situation awareness and threat assessment difficult. In this paper, we integrate vulnerabilities, weaknesses, affected platforms, tactics, attack techniques, and attack patterns into a coherent set of links. In addition, we propose an IoT security ontology model, namely, the IoT Security Threat Ontology (IoTSTO), to describe the elements of IoT security threats and design inference rules for threat analysis. This IoTSTO expands the current knowledge domain of cyber security ontology modeling. In the IoTSTO model, the proposed multi-source knowledge reasoning method can perform the following tasks: assess the threats of the IoT environment, automatically infer mitigations, and separate IoT nodes that are subject to specific threats. The method above provides support to security managers in their deployment of security solutions. This paper completes the association of current public knowledge bases for IoT security and solves the semantic heterogeneity of multi-source knowledge. In this paper, we reveal the scope of public knowledge bases and their interrelationships through the multi-source knowledge reasoning method for IoT security. In conclusion, the paper provides a unified, extensible, and reusable method for IoT security analysis and decision making.

Critical Relation Path Aggregation-Based Industrial Control Component Exploitable Vulnerability Reasoning

“…Wu et al expressed the relationships of attack scenarios in the SWRL rules and assessed potential threats by inferring vulnerabilities and their induced attacks [10]. Similarly, Zhang et al revealed the implicit relation based on the inference rules to discover vulnerable platforms in the IoT environments [18]. To some extent, ontology-based reasoning methods cannot meet the demands of cost computing and rule generation complexity when instances increase.…”

“…Algorithm 1: Continued ( 16) remove the last elements from cur_p_rela and cur_p_ent (17) end if (18) for each entity adj_ent and relation adj_rela adjacent to cur_ent do (19) if adj_ent is not in cur_p_ent then (20) DFS_SIM (adj_rela, adj_ent, cur_p_rela, cur_p_ent, p_vec, cur_sim, cur_len, e t , max_p_len, q_r_vec, cri_p_set) (21) end if (22) end for (23) remove the last elements from cur_p_rela and cur_p_ent (24) end function…”

An Automatic Assessment Method of Cyber Threat Intelligence Combined with ATT&CK Matrix

“…Related ATT&CK Attack Technology. ATT&CK abstractly describes a framework composed of sequential attack tactics, each of which covers abundant attack techniques [43]. ATT&CK framework can help organizations predict the adversary's attack behavior, gain a comprehensive understanding of the attack techniques that attackers may use, and provide mitigation measures.…”

Systematic Literature Review of Iot Metrics

“…Other papers have proposed IoT metrics for hardware, software, network, quality requirements, security requirements, etc. An example of the latter is the study by Zhang et al (2021) who proposed the IoT Security Threat Ontology (IoTSTO) as an IoT security ontology model to describe the elements of IoT security threats and threat analysis rules. Their model assists security managers in deploying IoT security solutions.…”