论文标题
基于图形卷积网络基于工业控制系统的可疑通信对估计
Graph Convolutional Network-based Suspicious Communication Pair Estimation for Industrial Control Systems
论文作者
论文摘要
白名单被认为是用于工业控制系统中使用的网络的有效安全监控方法，其中白名单由服务器的IP地址，TCP/UDP端口号和客户端地址（通信三重态）组成。但是，此方法会导致频繁的错误检测。为了减少由于简单的基于白名单的判断而导致的假阳性，我们提出了一个新的框架，以评分通信，以判断白名单中不存在的通信是正常的还是异常的。为了解决这个问题，我们使用关系图卷积网络开发了基于图形网络的可疑通信对估计，并评估了其性能。为此，我们收集了日本松下公司拥有的三个工厂的网络流量。所提出的方法在曲线下实现了接收器的工作特征区域，该区域的表现优于基线方法，例如DistMult，一种直接优化节点嵌入的方法和启发式方法，启发式方法使用一阶和二阶接近跨数的数字来对三联体进行评分。此方法使安全操作员能够专注于大量警报。
Whitelisting is considered an effective security monitoring method for networks used in industrial control systems, where the whitelists consist of observed tuples of the IP address of the server, the TCP/UDP port number, and IP address of the client (communication triplets). However, this method causes frequent false detections. To reduce false positives due to a simple whitelist-based judgment, we propose a new framework for scoring communications to judge whether the communications not present in whitelists are normal or anomalous. To solve this problem, we developed a graph convolutional network-based suspicious communication pair estimation using relational graph convolution networks, and evaluated its performance. For this, we collected the network traffic of three factories owned by Panasonic Corporation, Japan. The proposed method achieved a receiver operating characteristic area under the curve of 0.957, which outperforms baseline approaches such as DistMult, a method that directly optimizes the node embeddings, and heuristics, which score the triplets using first- and second-order proximities of multigraphs. This method enables security operators to concentrate on significant alerts.
