摘要:
随着信息技术产业的发展和物联网设备数量的增长，物联网安全防御的难度与复杂度不断上升，针对物联网与供应链的重大安全事件时有发生，这些事件揭示了物联网供应链安全管理的复杂性.目前存在许多信息安全公开知识库可用于物联网安全威胁分析，但知识库的异构性使威胁评估十分困难.对多个信息安全知识库进行研究，将防御方所关注的安全知识来源与攻击者的战术、技术和攻击模式整合成一个统一的关系映射链接图知识库，并导入威胁情报，旨在利用已披露的威胁事件来提升物联网安全威胁要素评估能力.提出了一个物联网供应链风险分析本体RIoTSCO，并以此模型为基础设计了物联网安全下的推理规则，利用本体的表达能力建立物联网安全领域知识之间的语义关系，以解决多源知识的语义异质性问题.同时，在一个物联网环境示例中基于所提方法进行安全评估，自动化推理缓解措施以应对威胁事件，并描绘威胁事件所能波及到的上下游供应链情报全貌.
Abstract:
With the development of the information technology industry and the increase of the number of IoT devices, the difficulty and complexity of IoT security defense are rising continuously. Major security incidents for IoT and the supply chain occur frequently, which reveals the complexity of the security management of the IoT supply chain. Nowadays, there are kinds of public knowledge bases about information security which can be used for the IoT security threat analysis. However, the heterogeneity of these knowledge bases makes it difficult for threat assessment. Aiming at improving the capabilities of threat elements assessment of IoT security, which used disclosed threat events, we exploit multiple information security knowledge bases, integrate the sources of security knowledge which the defenders are concerned about, and the tactics, attack patterns, attack techniques of attackers into a unified relational mapping linkages graph knowledge base. An IoT security ontology, namely, Risk Analysis of IoT Supply Chain Ontology (RIoTSCO) is constructed. Based on RIoTSCO, the inference rules of IoT security are defined to establish the semantic relationship among the knowledge bases of IoT security which can solve the semantic heterogeneity of multi-source knowledge. Meanwhile, based on the IoT security knowledge reasoning method proposed above in this paper, we conduct a security threat assessment on an IoT supply chain scenario. Moreover, RIoTSCO can also automatically infer mitigations in respond to threats, and describe the overall perspective of the inbound and outbound supply chain intelligences related to the threat events.
下载:
