基于证据理论物联网安全态势感知方法研究

doi:10.11959/j.issn.2096-109x.2022022

摘要/Abstract

摘要：

社会物联网技术迅速发展，安全问题日益严重，对简便易用的物联网安全态势感知方法进行了研究。针对当前物联网安全态势感知系统缺乏通用性、过分依赖专家知识的缺点，提出了一种基于改进D-S证据理论的物联网安全态势感知方法。利用模糊高斯隶属函数计算漏洞信息隶属度矩阵，归一化后作为证据分布矩阵；利用改进Topsis方法衡量证据可信度，聚合两两证据间的局部可信度，根据态势评估场景改进期望正负解向量，充分抑制冲突性证据可信度，提高相互支持证据间可信度，利用加权平均方法进行漏洞信息融合得到态势评估结果；基于时间因子折扣和高危漏洞比例折扣证据理论融合形成态势感知结果，利用时间因子聚合多个态势评估数据，根据时间尺度对不同时刻的态势评估证据进行折扣，越接近当前时刻的证据折扣度越小，反之越大。同时，综合考虑不同时刻物联网漏洞信息，利用高危漏洞比例信息进行自适应动态加权，把不同时刻的高危信息折扣入识别框架，系统的危险变化信息集中体现在证据融合过程中。经过实验表明，在不同数量证据体融合和4种常见冲突证据融合中，改进Topsis方法对可信命题的融合概率更高；在态势评估方面，准确评估当前系统危险程度；在态势感知方面，折扣理论可以充分预测高风险和紧急风险概率，比传统D-S证据理论更加有效。根据所提理论设计了一种物联网安全态势感知方法流程用于指导工程实践，未来在漏洞信息利用方面，可以考虑漏洞间的关联关系，提炼漏洞间更丰富的态势信息，使态势评估的结果更加准确合理，也可以借鉴博弈论的思想在攻击者、防御者动态博弈过程中进行态势感知。

关键词: D-S证据理论, 态势感知, 物联网安全, 时间演化, 通用漏洞评分系统

Abstract:

The security problem of IoT became more and more serious with its rapid development.Considering that the current IoT security situation awareness system lacks generality and excessively relies on expert knowledge, a IoT security situation awareness method based on improved D-S evidence theory was proposed in this paper.Fuzzy Gaussian membership function was used to calculate the vulnerability information membership matrix, which was normalized as evidence distribution matrix.The improved Topsis method was used to measure the evidence credibility.In order to fully restrain the credibility of conflicting evidence and improve the credibility of mutually supporting evidence, local credibility between two evidence was aggregated and the expected positive and negative solution vectors were improved according to the situation assessment scenario.And the weighted average method was used for vulnerability information fusion, to obtain the result of situational assessment.The result of situational awareness was fused with the time discount and high-risk vulnerability information discount evidence theory.At the same time, the IoT vulnerability information at different moments was considered comprehensively, the evidence was adaptively and dynamically weighted with the ratio information of high-risk vulnerability.The experimental results show that in the fusion of different numbers of evidence bodies and four common conflicting evidence, the improved Topsis method has higher fusion probability on credible proposition.In the aspect of situation assessment, the risk degree of current system is accurately assessed.And in the aspect of situational awareness, this discount evidence theory can predict the probability of high risk and critical risk, which is more effective than the traditional D-S evidence theory.According to this theory, a IoT security situational awareness method process was proposed, which would be used to guide engineering practice.In the future, the relationship between vulnerabilities can be considered and richer information between vulnerabilities can be extracted for vulnerability exploiting, so that the result of situation assessment is more accurate and reasonable.On the other hand, for situational awareness, game theory can be adopted in the process of dynamic game between the attacker and defender.

Key words: D-S evidence theory, situation awareness, IoT security, time evolution, CVSS

中图分类号:

TP393

李剑, 董廷鲁, 李劼. 基于证据理论物联网安全态势感知方法研究[J]. 网络与信息安全学报, 2022, 8(2): 39-47.

Jian LI, Tinglu DONG, Jie LI. Research on IoT security situation awareness method based on evidence theory[J]. Chinese Journal of Network and Information Security, 2022, 8(2): 39-47.

图/表 9

表1

不同数量证据体融合结果Table 1 Fusion result of different numbers of evidence"

方法	命题	m ₁,m₂	m ₁,m₂,m₃	m ₁,m₂ m₃,m₄	m ₁,m₂, m₃,m₄,m₅
	A	0.154 3	$0 . 5816$	$0 . 8060$	$0 . 8909$
文献[15]	B	$0 . 7469$	0.243 9	0.048 2	0.008 6
	C	0.098 8	0.174 5	0.145 8	0.100 5
	A	0.040 8	$0 . 6315$	$0 . 8785$	$0 . 9340$
本文方法	B	$0 . 9434$	0.259 9	0.028 7	0.003 8
	C	0.015 8	0.108 6	0.092 8	0.062 2

表1

表2

4种常见证据冲突融合结果Table 2 Fusion result of four conflicted evidence"

冲突类型	方法			命题
冲突类型	方法	A	B	C	D	E
完全冲突	文献[15]	$0 . 8166$	0.116 4	0.067 0	—	—
	本文方法	$0 . 9800$	0.019 0	0.001 0	—	—
0置信冲突	文献[15]	$0 . 4318$	0.295 5	0.272 7	—	—
	本文方法	$0 . 6149$	0.188 3	0.196 8	—	—
1置信冲突	文献[15]	0.138 8	0.131 8	$0 . 7294$	—	—
	本文方法	0.016 8	0.010 1	$0 . 9731$	—	—
高冲突	文献[15]	$0 . 5324$	0.152 1	0.146 2	0.045 1	0.124 1
	本文方法	$0 . 9744$	0.008 4	0.008 4	0.000 4	0.008 4

表2

图1

图2

表3

表4

表5

表6

图3

参考文献 17

[1]	杨毅宇, 周威, 赵尚儒 ,等. 物联网安全研究综述：威胁、检测与防御[J]. 通信学报, 2021,42(8): 188-205.
	YANG Y Y , ZHOU W , ZHAO S R ,et al. Survey of IoT security research:threats,detection and defense[J]. Journal on Communications, 2021,42(8): 188-205.
[2]	张方哲 . 物联网安全态势感知系统的研究与实现[D]. 济南:山东大学, 2021.
	ZHANG F Z . Research and implementation of Internet of things security situation awareness system[D]. Jinan:Shandong University, 2021.
[3]	龚俭, 臧小东, 苏琪 ,等. 网络安全态势感知综述[J]. 软件学报, 2017,28(4): 1010-1026.
	GONG J , ZANG X D , SU Q ,et al. Survey of network security situation awareness[J]. Journal of Software, 2017,28(4): 1010-1026.
[4]	简玲, 叶天鹏, 林祥 ,等. 多源融合的大数据网络安全态势感知平台研究与探索[J]. 信息网络安全, 2020,(S2).
	JIAN L , YE T P , LIN X ,et al. Research and exploration of multi-source fusion on big data network security situation awareness platform[J]. Netinfo Security, 2020,(S2).
[5]	LIVIA M B . An approach for information security risk assessment in cloud environments[J]. Informatica Economica Journal, 2020,24(4): 29-40.
[6]	ZENONAS T , NIKOLAJ Gn , ASSEL Na ,et al. Information security risk assessment in critical infrastructure:a hybrid MCDM approach[J]. Informatica. 2019,30(1): 187-211.
[7]	黄亭亭 . 水电工程洪水灾害链态势推演和应急决策的研究[D]. 武汉:华中科技大学, 2017.
	HUANG T T . Research on emergency situation evolution and emergency decision making for flood disaster chain of hydropower project construction[D]. WuHan:Huazhong University of Science and Technology, 2017.
[8]	BENAVOLI A , RISTIC B , FARINA A ,et al. An application of evidential networks to threat assessment[J]. IEEE Transactions on Aerospace and Electronic Systems, 2009,45(2): 620-639.
[9]	LIAO Y W , ZHAO G S , WANG J ,et al. Network security situation assessment model based on extended hidden markov[J]. Mathematical Problems in Engineering. 2020.
[10]	HAN Z , LI X , HUANG K ,et al. A software defined network based security assessment framework for cloud IoT[J]. IEEE Internet of Things Journal. 2018,5(3): 1424-1434.
[11]	魏青梅, 李宇博, 应雨龙 . 结合 Dempster-Shafer 证据理论与循环神经网络的网络安全态势预测[J]. 济南大学学报(自然科学版). 2020,34(3): 238-246.
	WEI Q M , LI Y B , YING L Y . Network security situation prediction based on Dempster-Shafer evidence theory and recurrent neural network[J]. Journal of University of Jinan(Science and Technology). 2020,34(3): 238-246.
[12]	PAN Z , WU Y . Building and testing network security situational awareness model based on bayesian method[C]// Third International Conference on Cyberspace Technology(CCT 2015). 2015: 1-4.
[13]	张欢, 陆见光, 唐向红 . 面向冲突证据的改进 DS 证据理论方法[J]. 北京航空航天大学学报, 2020,46(3): 616-623.
	ZHANG H , LU J G , TANG X H . An improved DS evidence theory algorithm for conflict evidence[J]. Journal of Beijing University of Aeronautics and Astronautics, 2020,46(3): 616-623.
[14]	LO H W , LIOU J J H . Comments on “factors influencing medical tourism adoption in malaysia:a DEMATEL-fuzzy TOPSIS approach”[J]. Computers ＆ Industrial Engineering, 2021,157.
[15]	邓勇, 施文康, 朱振福 . 一种有效处理冲突证据的组合方法[J]. 红外与毫米波学报. 2004,23(1): 27-32.
	DENG Y , SHI W K , ZHU Z F . Efficient combination approach of conflict evidence[J]. Journal of Infrared and Millimeter Waves. 2004,23(1): 27-32.
[16]	奚婷婷, 熊伟丽, 张林 ,等. 基于矩阵分析的 DS 合成算法[J]. 计算机工程, 2009,35(16): 264-266.
	XI T T , XIONG W L , ZHANG L ,et al. DS compositive algorithm based on matrix analysis[J]. Computer Engineering, 2009,35(16): 264-266.
[17]	秦涛, 鲁冬林, 曾拥华 . 基于D-S理论的分队级BDR能力指标评估模型研究[J]. 中国设备工程, 2021,(9): 153-155.
	QIN T , LU D L , ZENG Y H . Research on unit level BDR capability index evaluation model based on D-S Theory[J]. China Plant Engineering, 2021,(9): 153-155.

机器	CVE编号	漏洞	漏洞等级评估
主机1	CVE-2021-31939	v1	高危
数据库服务器	CVE-2021-26691	v2	紧急
Web服务器	CVE-2021-31970	v3	中危
蓝牙手环	CVE-2021-31974	v4	中危
Wi-Fi模块	CVE-2021-31169	v5	中危
Zigbee设备	CVE-2021-31205	v6	低危

时刻			评语集
时刻	无风险	低风险	中风险	高风险	紧急风险
T	0.002 5	0.185 1	0.631 6	0.117 0	0.063 8

时刻			评语集
时刻	无风险	低风险	中风险	高风险	紧急风险
T1	0.100 8	0.406 8	0.270 1	0.220 1	0.002 2
T2	0.012 0	0.214 5	0.589 7	0.123 5	0.060 3
T3	0.009 8	0.198 8	0.657 9	0.100 1	0.033 4
T4	0.010 1	0.098 7	0.246 9	0.532 7	0.111 6
T5	0.237 8	0.453 2	0.290 8	0.007 8	0.010 4
T6	0.079 0	0.076 4	0.473 2	0.256 5	0.114 9
T7	0.035 4	0.149 8	0.105 9	0.467 8	0.241 1
T8	0.000 1	0.203 2	0.593 3	0.176 4	0.027 0

方法			评语集			不确定值
方法	无风险	低风险	中风险	高风险	紧急风险	不确定值
传统D-S证据理论	0	0.008 0	0.990 9	0.001 1	0	—
本文方法	0.002 9	0.176 7	0.485 4	0.207 4	0.041 7	0.086 0