This file was created by the TYPO3 extension
bib
--- Timezone: CET
Creation date: 2024-03-29
Creation time: 05-52-48
--- Number of references
3
inproceedings
2023_sloun_accessibility
Poster: Vulcan - Repurposing Accessibility Features for Behavior-based Intrusion Detection Dataset Generation
2023
11
27
3543-3545
The generation of datasets is one of the most promising approaches to collecting the necessary behavior data to train machine learning models for host-based intrusion detection. While various dataset generation methods have been proposed, they are often limited and either only generate network traffic or are restricted to a narrow subset of applications. We present Vulcan, a preliminary framework that uses accessibility features to generate datasets by simulating user interactions for an extendable set of applications. It uses behavior profiles that define realistic user behavior and facilitate dataset updates upon changes in software versions, thus reducing the effort required to keep a dataset relevant. Preliminary results show that using accessibility features presents a promising approach to improving the quality of datasets in the HIDS domain.
Intrusion Detection, Dataset Generation, Accessibility Features
https://www.comsys.rwth-aachen.de/fileadmin/papers/2023/2023-sloun-vulcan-accessibility.pdf
ACM
Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS '23), November 26-30, 2023, Copenhagen, Denmark
Copenhagen, Denmark
November 26-30, 2023
979-8-4007-0050-7/23/11
10.1145/3576915.3624404
1
Christianvan Sloun
KlausWehrle
proceedings
2022-wolsing-radarsec
Network Attacks Against Marine Radar Systems: A Taxonomy, Simulation Environment, and Dataset
2022
9
rfc
https://www.comsys.rwth-aachen.de/fileadmin/papers/2022/2022-wolsing-radar.pdf
IEEE
Edmonton, Canada
47th IEEE Conference on Local Computer Networks (LCN)
September 26-29, 2022
10.1109/LCN53696.2022.9843801
1
KonradWolsing
AntoineSaillard
JanBauer
EricWagner
Christianvan Sloun
Ina BereniceFink
MariSchmidt
KlausWehrle
MartinHenze
inproceedings
2022-wolsing-simple
Can Industrial Intrusion Detection Be SIMPLE?
2022
9
978-3-031-17143-7
574--594
Cyberattacks against industrial control systems pose a serious risk to the safety of humans and the environment. Industrial intrusion detection systems oppose this threat by continuously monitoring industrial processes and alerting any deviations from learned normal behavior. To this end, various streams of research rely on advanced and complex approaches, i.e., artificial neural networks, thus achieving allegedly high detection rates. However, as we show in an analysis of 70 approaches from related work, their inherent complexity comes with undesired properties. For example, they exhibit incomprehensible alarms and models only specialized personnel can understand, thus limiting their broad applicability in a heterogeneous industrial domain. Consequentially, we ask whether industrial intrusion detection indeed has to be complex or can be SIMPLE instead, i.e., Sufficient to detect most attacks, Independent of hyperparameters to dial-in, Meaningful in model and alerts, Portable to other industrial domains, Local to a part of the physical process, and computationally Efficient. To answer this question, we propose our design of four SIMPLE industrial intrusion detection systems, such as simple tests for the minima and maxima of process values or the rate at which process values change. Our evaluation of these SIMPLE approaches on four state-of-the-art industrial security datasets reveals that SIMPLE approaches can perform on par with existing complex approaches from related work while simultaneously being comprehensible and easily portable to other scenarios. Thus, it is indeed justified to raise the question of whether industrial intrusion detection needs to be inherently complex.
https://www.comsys.rwth-aachen.de/fileadmin/papers/2022/2022-wolsing-simple.pdf
Atluri, Vijayalakshmi and Di Pietro, Roberto and Jensen, Christian D. and Meng, Weizhi
Springer Nature Switzerland
Proceedings of the 27th European Symposium on Research in Computer Security (ESORICS '22), September 26-30, 2022, Copenhagen, Denmark
Copenhagen, Denmark
27th European Symposium on Research in Computer Security (ESORICS)
September 26-30, 2022
10.1007/978-3-031-17143-7_28
1
KonradWolsing
LeaThiemt
Christianvan Sloun
EricWagner
KlausWehrle
MartinHenze