TY - GEN
T1 - MNSSA
T2 - 20th IEEE International Conference on Automation Science and Engineering, CASE 2024
AU - Zhang, Shilong
AU - Zhang, Hui
AU - Chen, Guo
AU - Luo, He
AU - Wu, Meiqi
AU - Chen, Hongxiang
AU - Ren, Zehua
AU - Wang, Zijun
AU - Liu, Yang
N1 - Publisher Copyright:
© 2024 IEEE.
PY - 2024
Y1 - 2024
N2 - Intrusion detection systems (IDSs) are widely used for generating alarms indicating potential network security risks based on network traffic monitoring in industrial control systems (ICSs). However, it is a big burden for security analysts to handle numerous alarms in real time. Also, most alarms are falsely triggered by normal operations, which makes the real attack risks hard to find. In this paper, we propose MNSSA, a meso-level network security situation awareness method that conducts graph evolution analysis on the ICS alarms. MNSSA can semi-automatically filter low-risk false alarms in bulk and detect attack events. It can better analyze the network security situation and improve alarm processing efficiency.
AB - Intrusion detection systems (IDSs) are widely used for generating alarms indicating potential network security risks based on network traffic monitoring in industrial control systems (ICSs). However, it is a big burden for security analysts to handle numerous alarms in real time. Also, most alarms are falsely triggered by normal operations, which makes the real attack risks hard to find. In this paper, we propose MNSSA, a meso-level network security situation awareness method that conducts graph evolution analysis on the ICS alarms. MNSSA can semi-automatically filter low-risk false alarms in bulk and detect attack events. It can better analyze the network security situation and improve alarm processing efficiency.
UR - https://www.scopus.com/pages/publications/85208248187
U2 - 10.1109/CASE59546.2024.10711716
DO - 10.1109/CASE59546.2024.10711716
M3 - 会议稿件
AN - SCOPUS:85208248187
T3 - IEEE International Conference on Automation Science and Engineering
SP - 3628
EP - 3634
BT - 2024 IEEE 20th International Conference on Automation Science and Engineering, CASE 2024
PB - IEEE Computer Society
Y2 - 28 August 2024 through 1 September 2024
ER -