新一代信息技术与工业系统深度融合,提升了工业控制系统和工业设备网络的连接性,使得工业互联网成为APT攻击的重点目标.针对现有偏向于静态认证的方法难以识别APT攻击者控制内部失陷终端获取的“傀儡身份”,进而造成敏感数据泄露的问题...新一代信息技术与工业系统深度融合,提升了工业控制系统和工业设备网络的连接性,使得工业互联网成为APT攻击的重点目标.针对现有偏向于静态认证的方法难以识别APT攻击者控制内部失陷终端获取的“傀儡身份”,进而造成敏感数据泄露的问题,提出一种面向工业互联网的零信任动态认证方案.融合CNN-BiLSTM构建混合神经网络,利用其时序特性设计行为因子预测模型.通过多个残差块组成的深度卷积网络提取特征,双向长短时记忆网络(bidirectional long short-term memory,BiLSTM)进行时间序列分析,生成对主体的行为因子预测,作为零信任动态认证重要凭据.为快速识别“傀儡身份”,融入行为因子设计IPK-SPA动态认证机制.利用轻量级标识公钥技术适应工业互联网海量末梢,借助零信任单包授权技术隐藏工控网络边界.安全性分析和实验结果表明,提出的动态认证方案具有较好的“傀儡身份”识别能力,有助于抗击工业互联网环境下因APT攻击者窃取身份导致的数据窃密威胁.展开更多
The increase in number of people using the Internet leads to increased cyberattack opportunities.Advanced Persistent Threats,or APTs,are among the most dangerous targeted cyberattacks.APT attacks utilize various advan...The increase in number of people using the Internet leads to increased cyberattack opportunities.Advanced Persistent Threats,or APTs,are among the most dangerous targeted cyberattacks.APT attacks utilize various advanced tools and techniques for attacking targets with specific goals.Even countries with advanced technologies,like the US,Russia,the UK,and India,are susceptible to this targeted attack.APT is a sophisticated attack that involves multiple stages and specific strategies.Besides,TTP(Tools,Techniques,and Procedures)involved in the APT attack are commonly new and developed by an attacker to evade the security system.However,APTs are generally implemented in multiple stages.If one of the stages is detected,we may apply a defense mechanism for subsequent stages,leading to the entire APT attack failure.The detection at the early stage of APT and the prediction of the next step in the APT kill chain are ongoing challenges.This survey paper will provide knowledge about APT attacks and their essential steps.This follows the case study of known APT attacks,which will give clear information about the APT attack process—in later sections,highlighting the various detection methods defined by different researchers along with the limitations of the work.Data used in this article comes from the various annual reports published by security experts and blogs and information released by the enterprise networks targeted by the attack.展开更多
平均功率追踪(Average Power Tracking, APT)电源芯片过流失效甚至烧毁会导致整个无线移动通信终端设备无法正常工作。针对这一问题,结合降压(Buck)模式APT电源芯片失效的场景,提出了通过优化过流保护电路参数和有效拦截因制造工艺波动...平均功率追踪(Average Power Tracking, APT)电源芯片过流失效甚至烧毁会导致整个无线移动通信终端设备无法正常工作。针对这一问题,结合降压(Buck)模式APT电源芯片失效的场景,提出了通过优化过流保护电路参数和有效拦截因制造工艺波动而导致不良电源芯片漏测的措施。一方面,在设计过流保护电路时,选取不同电感值的储能电感,对比不同电感值电路的电流纹波大小,分析不同纹波大小和芯片过流保护之间的关系,给出了通过选择合适的电感值来提高电源过流保护的方法。另一方面,在APT电源芯片生产测试环节使用By Pass模式,直接评估芯片的最大负载电流值与过流保护电流值,有效拦截过流保护不良的芯片。通过以上措施,无线移动通信终端设备的APT电源芯片过流保护的性能得到了质的飞跃,市场产品因为APT电源过流烧毁的概率几乎为0,产品质量信誉得到了很大的提升。展开更多
文摘新一代信息技术与工业系统深度融合,提升了工业控制系统和工业设备网络的连接性,使得工业互联网成为APT攻击的重点目标.针对现有偏向于静态认证的方法难以识别APT攻击者控制内部失陷终端获取的“傀儡身份”,进而造成敏感数据泄露的问题,提出一种面向工业互联网的零信任动态认证方案.融合CNN-BiLSTM构建混合神经网络,利用其时序特性设计行为因子预测模型.通过多个残差块组成的深度卷积网络提取特征,双向长短时记忆网络(bidirectional long short-term memory,BiLSTM)进行时间序列分析,生成对主体的行为因子预测,作为零信任动态认证重要凭据.为快速识别“傀儡身份”,融入行为因子设计IPK-SPA动态认证机制.利用轻量级标识公钥技术适应工业互联网海量末梢,借助零信任单包授权技术隐藏工控网络边界.安全性分析和实验结果表明,提出的动态认证方案具有较好的“傀儡身份”识别能力,有助于抗击工业互联网环境下因APT攻击者窃取身份导致的数据窃密威胁.
文摘The increase in number of people using the Internet leads to increased cyberattack opportunities.Advanced Persistent Threats,or APTs,are among the most dangerous targeted cyberattacks.APT attacks utilize various advanced tools and techniques for attacking targets with specific goals.Even countries with advanced technologies,like the US,Russia,the UK,and India,are susceptible to this targeted attack.APT is a sophisticated attack that involves multiple stages and specific strategies.Besides,TTP(Tools,Techniques,and Procedures)involved in the APT attack are commonly new and developed by an attacker to evade the security system.However,APTs are generally implemented in multiple stages.If one of the stages is detected,we may apply a defense mechanism for subsequent stages,leading to the entire APT attack failure.The detection at the early stage of APT and the prediction of the next step in the APT kill chain are ongoing challenges.This survey paper will provide knowledge about APT attacks and their essential steps.This follows the case study of known APT attacks,which will give clear information about the APT attack process—in later sections,highlighting the various detection methods defined by different researchers along with the limitations of the work.Data used in this article comes from the various annual reports published by security experts and blogs and information released by the enterprise networks targeted by the attack.
文摘平均功率追踪(Average Power Tracking, APT)电源芯片过流失效甚至烧毁会导致整个无线移动通信终端设备无法正常工作。针对这一问题,结合降压(Buck)模式APT电源芯片失效的场景,提出了通过优化过流保护电路参数和有效拦截因制造工艺波动而导致不良电源芯片漏测的措施。一方面,在设计过流保护电路时,选取不同电感值的储能电感,对比不同电感值电路的电流纹波大小,分析不同纹波大小和芯片过流保护之间的关系,给出了通过选择合适的电感值来提高电源过流保护的方法。另一方面,在APT电源芯片生产测试环节使用By Pass模式,直接评估芯片的最大负载电流值与过流保护电流值,有效拦截过流保护不良的芯片。通过以上措施,无线移动通信终端设备的APT电源芯片过流保护的性能得到了质的飞跃,市场产品因为APT电源过流烧毁的概率几乎为0,产品质量信誉得到了很大的提升。
