[论文解读] A Taxonomy of Network Threats and the Effect of Current Datasets on Intrusion Detection Systems

Hanan Hindy, David Brosset+5 more|Middlesex University Research Repository (Middlesex University Of London)|Jun 9, 2018

Network Security and Intrusion Detection参考文献 79被引用 99

一句话总结

该论文对 IDS 数据集进行了综述，并提出了威胁分类法，发现当前的 IDS 仅覆盖少数威胁，数据集缺乏真实世界的威胁表征，阻碍检测性能。

ABSTRACT

As the world moves towards being increasingly dependent on computers and automation, building secure applications, systems and networks are some of the main challenges faced in the current decade. The number of threats that individuals and businesses face is rising exponentially due to the increasing complexity of networks and services of modern networks. To alleviate the impact of these threats, researchers have proposed numerous solutions for anomaly detection; however, current tools often fail to adapt to ever-changing architectures, associated threats and zero-day attacks. This manuscript aims to pinpoint research gaps and shortcomings of current datasets, their impact on building Network Intrusion Detection Systems (NIDS) and the growing number of sophisticated threats. To this end, this manuscript provides researchers with two key pieces of information; a survey of prominent datasets, analyzing their use and impact on the development of the past decade's Intrusion Detection Systems (IDS) and a taxonomy of network threats and associated tools to carry out these attacks. The manuscript highlights that current IDS research covers only 33.3% of our threat taxonomy. Current datasets demonstrate a clear lack of real-network threats, attack representation and include a large number of deprecated threats, which together limit the detection accuracy of current machine learning IDS approaches. The unique combination of the taxonomy and the analysis of the datasets provided in this manuscript aims to improve the creation of datasets and the collection of real-world data. As a result, this will improve the efficiency of the next generation IDS and reflect network threats more accurately within new datasets.

研究动机与目标

• 评估可用基于网络的数据集的局限性及其对 IDS 开发的影响。
• 回顾过去十年的 NIDS 研究及其评估实践。
• 提出按来源、OSI 层和活动模式分类的威胁分类法，以指导数据集创建。
• 将当前威胁映射到相关工具，帮助研究人员构建更具代表性的数据集。

提出的方法

• 调研知名的 IDS 数据集并分析其在过去十年中对 IDS 开发的使用与影响。
• 评审最近的 ML/NIDS 研究以识别算法趋势和数据集依赖。
• 构建与 OSI 层级及主动/被动威胁特征对齐的威胁分类法。
• 将威胁映射到其攻击工具，以支持数据集构建和基准测试。
• 讨论数据集生成标准和标准，以提高真实感和可重用性。

实验结果

研究问题

• RQ1 可用的基于网络的数据集在 IDS 开发中的主要局限性是什么？
• RQ2 当前数据集在多大程度上反映现实世界的网络威胁和零日攻击？
• RQ3 在数据集和威胁覆盖的差距下，最近的 IDS 方法的表现如何？
• RQ4 威胁分类法和工具映射如何引导创建更具代表性的数据集？

主要发现

• 当前的 IDS 研究仅覆盖所提出威胁分类法的约 33.3%。
• 当前数据集缺乏真实网络威胁、攻击表征，并且包含许多已弃用的威胁。
• 这些数据集的不足限制了当代基于机器学习的 IDS 的检测准确性。
• 研究人员应开发可扩展、标准化的数据集生成平台，以应对网络模式中的概念漂移。
• 分析凸显了某些数据集（如 KDD-99、DARPA）的主导地位，以及需要更新的基准以反映现代威胁。
• 将威胁映射到 OSI 层及相关工具可以指导数据集创建并改进 IDS 基准测试。