Threat Modeling and Application Research Based on Multi-Source Attack and Defense Knowledge

Cyber Threat Intelligence(CTI)is a valuable resource for cybersecurity defense,but it also poses challenges due to its multi-source and heterogeneous nature.Security personnel may be unable to use CTI effectively to understand the condition and trend of a cyberattack and respond promptly.To address these challenges,we propose a novel approach that consists of three steps.First,we construct the attack and defense analysis of the cybersecurity ontology(ADACO)model by integrating multiple cybersecurity databases.Second,we develop the threat evolution prediction algorithm(TEPA),which can automatically detect threats at device nodes,correlate and map multisource threat information,and dynamically infer the threat evolution process.TEPA leverages knowledge graphs to represent comprehensive threat scenarios and achieves better performance in simulated experiments by combining structural and textual features of entities.Third,we design the intelligent defense decision algorithm(IDDA),which can provide intelligent recommendations for security personnel regarding the most suitable defense techniques.IDDA outperforms the baseline methods in the comparative experiment.

Impact of ionospheric irregularity on SBAS integrity:spatial threat modeling and improvement

The ionosphere, as the largest and least predictable error source, its behavior cannot be observed at all places simultaneously. The confidence bound, called the grid ionospheric vertical error(GIVE), can only be determined with the aid of a threat model which is used to restrict the expected ionospheric behavior. However, the spatial threat model at present widespread used, which is based on fit radius and relative centroid metric(RCM), is too conservative or the resulting GIVEs will be too large and will reduce the availability of satellite-based augmentation system(SBAS). In this paper, layered two-dimensional parameters, the vertical direction double RCMs, are introduced based on the spatial variability of the ionosphere. Comparing with the traditional threat model, the experimental results show that the user ionospheric vertical error(UIVE) average reduction rate reaches 16%. And the 95% protection level of conterminous United States(CONUS) is 28%, even under disturbed days, which reaches about 5% reduction rates.The results show that the system service performance has been improved better.

Threat Modeling-Oriented Attack Path Evaluating Algorithm

In order to evaluate all attack paths in a threat tree,based on threat modeling theory,a weight distribution algorithm of the root node in a threat tree is designed,which computes threat coefficients of leaf nodes in two ways including threat occurring possibility and the degree of damage.Besides,an algorithm of searching attack path was also obtained in accordence with its definition.Finally,an attack path evaluation system was implemented which can output the threat coefficients of the leaf nodes in a target threat tree,the weight distribution information,and the attack paths.An example threat tree is given to verify the effectiveness of the algorithms.

Application Research on Two-Layer Threat Prediction Model Based on Event Graph

Advanced Persistent Threat(APT)is now the most common network assault.However,the existing threat analysis models cannot simultaneously predict the macro-development trend and micro-propagation path of APT attacks.They cannot provide rapid and accurate early warning and decision responses to the present system state because they are inadequate at deducing the risk evolution rules of network threats.To address the above problems,firstly,this paper constructs the multi-source threat element analysis ontology(MTEAO)by integrating multi-source network security knowledge bases.Subsequently,based on MTEAO,we propose a two-layer threat prediction model(TL-TPM)that combines the knowledge graph and the event graph.The macro-layer of TL-TPM is based on the knowledge graph to derive the propagation path of threats among devices and to correlate threat elements for threat warning and decision-making;The micro-layer ingeniously maps the attack graph onto the event graph and derives the evolution path of attack techniques based on the event graph to improve the explainability of the evolution of threat events.The experiment’s results demonstrate that TL-TPM can completely depict the threat development trend,and the early warning results are more precise and scientific,offering knowledge and guidance for active defense.

Cyber Resilience through Real-Time Threat Analysis in Information Security

This paper examines how cybersecurity is developing and how it relates to more conventional information security. Although information security and cyber security are sometimes used synonymously, this study contends that they are not the same. The concept of cyber security is explored, which goes beyond protecting information resources to include a wider variety of assets, including people [1]. Protecting information assets is the main goal of traditional information security, with consideration to the human element and how people fit into the security process. On the other hand, cyber security adds a new level of complexity, as people might unintentionally contribute to or become targets of cyberattacks. This aspect presents moral questions since it is becoming more widely accepted that society has a duty to protect weaker members of society, including children [1]. The study emphasizes how important cyber security is on a larger scale, with many countries creating plans and laws to counteract cyberattacks. Nevertheless, a lot of these sources frequently neglect to define the differences or the relationship between information security and cyber security [1]. The paper focus on differentiating between cybersecurity and information security on a larger scale. The study also highlights other areas of cybersecurity which includes defending people, social norms, and vital infrastructure from threats that arise from online in addition to information and technology protection. It contends that ethical issues and the human factor are becoming more and more important in protecting assets in the digital age, and that cyber security is a paradigm shift in this regard [1].

Blockchain applied to the construction supply chain:A case study with threat model

The construction industry has long faced the challenge of introducing collaborative systems among multiple stakeholders.This challenge creates a high level of rigidity in terms of processing shared information related to different processes,robust holistic regulations,payment actualizations,and resource utilization across different nodes.The need for a digital platform to crossconnect all stakeholders is necessary.A blockchain-based platform is a prime candidate to improve the industry in general and the construction supply chain(CSC)in particular.In this paper,a literature review is presented to establish the main challenges that CSC faces in terms of its effects on productivity and efficiency.In addition,the effect of applying blockchain platforms on a case study is presented and analyzed from performance and security level.The analysis aims to emphasize that blockchain,as presented in this paper,is a viable solution to the challenges in the CSC regardless of the risks associated with the security and robustness of the flow of information and data protection.Moreover,a threat analysis of applying a blockchain model on the CSC industry is introduced.This model indicates potential attacks and possible countermeasures to prevent the attacks.Future work is needed to expand,quantify,and optimize the threat model and conduct simulations considering proposed countermeasures for the different blockchain attacks outlined in this study.

Automating threat modeling using an ontology framework

Threat modeling is of increasing importance to IT security,and it is a complex and resource demanding task.The aim of automating threat modeling is to simplify model creation by using data that are already available.However,the collected data often lack context;this can make the automated models less precise in terms of domain knowledge than those created by an expert human modeler.The lack of domain knowledge in modeling automation can be addressed with ontologies.In this paper,we introduce an ontology framework to improve automatic threat modeling.The framework is developed with conceptual modeling and validated using three different datasets:a small scale utility lab,water utility control network,and university IT environment.The framework produced successful results such as standardizing input sources,removing duplicate name entries,and grouping application software more logically.

Automating threat modeling using an ontology framework

Threat modeling is of increasing importance to IT security,and it is a complex and resource demanding task.The aim of automating threat modeling is to simplify model creation by using data that are already available.However,the collected data often lack context;this can make the automated models less precise in terms of domain knowledge than those created by an expert human modeler.The lack of domain knowledge in modeling automation can be addressed with ontologies.In this paper,we introduce an ontology framework to improve automatic threat modeling.The framework is developed with conceptual modeling and validated using three different datasets:a small scale utility lab,water utility control network,and university IT environment.The framework produced successful results such as standardizing input sources,removing duplicate name entries,and grouping application software more logically.

大语言模型在威胁情报生成方面的研究进展

在计算机语言处理的广阔领域中,一种被称为大语言模型的革命性实体崭露头角,以其理解复杂语言模式和产生一致且上下文相关回应的巨大能力而引起关注.大语言模型是一种人工智能模型,已经成为各种任务的强大工具,包括自然语言处理、机器翻译和问答.在威胁情报的实际应用中这些模型表现出色,特别是在实体识别、事件分析和关系抽取等关键任务上取得了显著的优势.其上下文理解的能力使其能够更好地处理复杂的威胁情境,而多层次表示学习使其能够捕捉文本的不同层次结构.此外,大语言模型通过迁移学习的方式,将在通用语言理解上获得的知识迁移到威胁情报任务中,提高了模型对不同领域和特定任务的适应性.这一研究趋势不仅推动了威胁情报领域的技术创新,也为更加智能、高效的威胁分析和应对提供了新的可能性.然而,随着研究的深入,仍需解决数据异构性、隐私保护等问题,以便更好地推动大语言模型在威胁情报领域的可持续发展.

面向突防的滑翔制导炮弹弹道规划方法

针对滑翔制导炮弹在不可避免的威胁区域内选择突防方案的问题,从量化威胁值的角度建立了敌方防御手段的数学模型,基于模型设计了全程综合威胁值最低的规划指标,提出考虑目标防御威胁的弹道规划方法。为实现滑翔制导炮弹全程飞行过程中初始弹道倾角、偏角、火箭点火时刻、滑翔启控时刻等各参数的最佳匹配,建立了多阶段全弹道规划模型,并采用hp自适应伪谱法将最优控制问题转换为非线性规划问题求解。通过仿真验证了在该指标下滑翔制导炮弹对目标防御的规避效果,分析了影响有效性的因素。与传统弹道规划方法进行对比,证明了所提方法的优越性。

基于SIR模型的无线网络安全威胁态势量化评估算法

为确保网络安全,及时掌控安全状况,以易感者、感染者和免疫者(SIR:Susceptible Infected Recovered)模型为基础,面向无线网络提出安全威胁态势量化评估算法。选取资产价值性,系统脆弱性与威胁性作为量化评估指标,分别根据信息资产的安全属性与主机劣势的Agent检测值,得到价值性量化值与脆弱性量化值。基于病毒的传播特性,改进SIR模型,分析病毒传播特征,获得威胁性量化值。结合3个指标量化值,建立无线网络安全威胁态势的量化评估算法,用所得态势值评估网络安全状况。测试结果表明,该方法评估出的主机与整个无线网络的安全威胁态势值均与期望值高度拟合,且评估时间更短。所提算法具备良好的评估准确性与实时性,能为网络安全状况分析提供有效的数据依据,及时给予管理员可靠的决策支持。

一种基于威胁模型的安全测试用例生成框架和工具

近年来,软件系统安全问题正引发越来越多的关注,系统存在的安全威胁容易被攻击者所利用,攻击者通常采用各种攻击技术诸如口令暴力破解、网络钓鱼、SQL注入等对系统进行攻击.威胁建模是一种结构化分析、识别并处理威胁的方法,传统的测试主要集中在测试代码缺陷,处于软件开发后期,不能很好地对接前期威胁建模分析成果以构建安全的软件,业界威胁建模工具缺少进一步生成安全测试的功能.为了应对此问题,提出一种从威胁模型生成安全测试用例的框架,并设计和实现工具原型.为了便于测试,对传统的攻击树模型进行改进,对构建的模型进行规范性检查,从该模型中可以自动生成测试线索.根据攻击节点发生概率对测试线索进行评估,优先检测概率较高的威胁的测试线索.对防御节点进行评估,选择收益性较高的防御方案缓解威胁,以改进系统安全设计.通过为攻击节点设置参数可以将测试线索转换成具体的测试用例.在软件开发早期阶段以威胁建模识别出的威胁作为输入,通过框架和工具可以生成测试,指导后续的安全开发和安全测试设计,将安全技术更好地嵌入到软件设计和开发之中.案例研究部分将该框架和工具运用于极高危风险的安全测试生成,并说明了其有效性.

基于预训练模型的漏洞信息检索系统研究

[研究目的]威胁情报中漏洞信息是指有关网络、系统、应用程序或供应链中存在的漏洞的信息。目前搜索引擎在漏洞信息检索上存在短板,利用预训练模型来构建漏洞检索系统可以提高检索效率。[研究方法]以公开的漏洞信息作为数据来源,构建了一个问答数据集,对Tiny Bert进行增量预训练。使用模型对于每个查询向量化,并把漏洞信息构建成faiss向量数据库,利用HNSW索引进行多通道和单通道召回检索。然后对模型进行对比学习微调生成双塔和单塔模型,利用双塔召回和单塔精排构建了一个简易的知识检索系统。[研究结论]实验结果表明,预训练模型可以显著地提升检索性能,对比学习微调的双塔模型在构建的漏洞信息测试集中TOP1召回率为92.17%。通过漏洞信息领域的检索实践,对构建威胁情报的检索系统提供了参考。

SRS-SafeSec:安全相关系统一体化安全建模分析方法

随着工业控制系统接入互联网,安全相关系统传统的功能安全领域面临来自信息安全的威胁与挑战,然而现有的威胁建模方法对于信息安全和功能安全的融合分析不足。对安全相关系统的冗余结构进行信息安全威胁分析,确定安全相关系统的信息安全约束,提出安全相关系统的一体化威胁模型SRS-SafeSec。实验中分别使用SRS-SafeSec方法和STPA-SafeSec方法对光气反应仿真系统进行威胁建模,比较建模方法的完备性与融合性,实验结果表明SRS-SafeSec具有更好的完备性。

基于预训练模型和中英文威胁情报的TTP识别方法研究

TTP情报主要存在于非结构化的威胁报告中,是一种具有重要价值的网络威胁情报。然而,目前开源的TTP分类标签数据集主要集中在英文领域,涵盖的语料来源与TTP种类较为有限,特别是缺乏中文领域的相关数据。针对该情况,文章构建了一个中英文TTP情报数据集BTICD,该数据集包含17700条样本数据与236种对应的TTP。BTICD首次利用了公开的中文威胁报告语料进行TTP标注,且标注了一部分无法映射到任何一种TTP的白样本数据。文章基于预训练模型构建,并在该双语数据集上微调得到双语TTP识别模型SecBiBERT。实验结果表明,SecBiBERT在50种常见TTP分类任务上的Micro F1分数达到86.49%,在全量236类TTP分类任务上Micro F1分数达到73.09%,识别性能表现良好。

网络安全威胁检测中基于大语言模型的实时分析策略研究

随着网络技术的发展,网络安全威胁检测成为信息安全的重要研究课题。传统方法难以应对日益增长的数据量和复杂的攻击手段。基于大语言模型的实时分析策略在威胁检测中展现出独特优势。研究构建了一种基于来自Transformers的双向编码器表示(Bidirectional Encoder Representations from Transformers,BERT)模型的新架构,整合自然语言处理技术,提出了包含句子结构分析、语义关联识别和异常模式识别的多层检测算法。对比传统方法,该策略对高级持续威胁(Advanced Persistent Threat,APT)和零日攻击的检测率超过95%,且误报率较低。模型训练和测试集涵盖广泛攻击场景,可以确保检测前瞻性和广泛适用性。该策略不仅在技术层面创新,还提升了网络安全防御的实效性,显示出良好的适应性和扩展性,未来有望成为网络安全防御的新范式。

信息系统“Insider threat”分析及其解决方案

为了更好地辅助管理人员对信息系统安全策略配置的系统化认识,对具有代表性的内部威胁的分类和建模方法进行了分析研究,并比较了各种方法的优、缺点。同时,在探讨了减少内部威胁的不同解决方案的基础上,提出了一个能尽可能减少内部威胁的改良方案。

基于传染病和网络流模型分析APT攻击对列车控制系统的影响

高级可持续威胁(APT)是目前工业控制系统面临的主要威胁之一。APT攻击利用计算机设备漏洞入侵列车控制网络,感染并且扩散到网络中的其他设备,影响系统正常运行,因此评价APT攻击对列车控制系统的影响非常必要。提出一种基于传染病模型和网络流理论结合的APT攻击影响分析方法。首先,分析在APT攻击的不同阶段设备节点状态之间的转化规则,结合传染病理论建立APT攻击传播模型,研究攻击过程中的节点状态变化趋势;其次,把设备节点的状态变化融入网络流模型中,研究APT攻击过程中设备节点状态变化对列车控制网络中列车移动授权信息流的影响;最后,结合列车控制系统的信息物理耦合关系,分析APT攻击对列控系统整体性能的影响。仿真实验展现了APT攻击过程中节点状态变化的趋势,验证该方法在分析APT病毒软件在列车控制网络中的传播过程对列车控制系统整体性能影响的有效性,为管理者制定防御方案提供依据,提升列车控制系统信息安全水平。

基于代价损失函数的空中目标决策划分方法

面向为空中威胁目标提供威胁等级划分并提供辅助打击决策,基于改进的VIKOR法和三支决策中损失函数与阈值之间的关系,对威胁估计和决策划分问题方法进行研究。对评估属性进行分析建模,并利用AHP法计算权重。建立三支模型,利用改进的VIKOR法计算目标条件概率完成目标威胁排序。通过结合三支决策模型中的代价损失函数和阈值参数之间的关系,将求阈值与代价损失函数的方法转化为最优化问题,并利用PSO算法解决问题。最后,结合所得阈值,对论域内目标进行威胁等级与决策划分。实例分析表明,该方法在一定范围内保证最小的威胁等级和决策划分代价的同时考虑了决策者的心理,达到预期的目标威胁评估结果。

Security Threats to Business Information Systems Using NFC Read/Write Mode

Radio Frequency IDentification(RFID)and related technologies such as Near Field Communication(NFC)are becoming essential in industrial contexts thanks to their ability to perform contactless data exchange,either device-to-device or tag-to-device.One of the three main operation modes of NFC,called read/write mode,makes use of the latter type of interaction.It is extensively used in business information systems that make use of NFC tags to provide the end-user with augmented information in one of several available NFC data exchange formats,such as plain text,simple URLs or enriched URLs.Using a wide variety of physical form factors,NFC-compatible tags(wireless transponders)are currently available in many locations with applications going from smart posters,contactless tokens,tap-and-go payments or transport ticketing to automated device configuration,patient identification at hospitals or inventory management within supply chains.Most of these applications handle sensitive processes or data.This paper proposes a complete security threat model for the read/write operation mode of NFC used in Next Generation Industrial IoT(Nx-IIoT)contexts.This model,based on a wellknown methodology,STRIDE,allows developers and users to identify NFC applications vulnerabilities or weaknesses,analyze potential threats,propose risk management strategies,and design mitigation mechanisms to mention only some significant examples.