通过学习系统安全行为模式,实现对未知攻击的精准识别。
Formal Models and Convergence Analysis for Context-Aware Security Verification
- 基于重建学习捕捉系统安全特征,结合上下文推理判断漏洞
- 全上下文条件下检测准确率达82%,未知攻击识别提升31%
- 适合安全研究者和防御系统开发者,尤其关注新型威胁防护
传统安全扫描器在面对新攻击模式时失效,因其依赖固定规则和预设签名,无法察觉未知威胁。本文提出一种根本性新方法:不记忆具体攻击特征,而是学习系统真正安全的本质。核心洞察是:上下文决定漏洞。同一SQL语句在不同环境中可能安全或危险。通过建模上下文-漏洞关系,系统能检测从未见过的攻击。我们引入上下文感知验证,从真实安全系统中进行重建学习,捕获其本质特征。当未知攻击偏离这些模式时,系统即可识别,无需事先知晓该攻击类型。理论证明检测率随上下文信息I(W;C)呈指数提升。框架包含三部分:(1) 重建学习建模安全行为,(2) 多尺度图推理聚合上下文线索,(3) 基于重建差异的注意力机制。大量实验验证:完整上下文下检测准确率从58%升至82%,未知攻击检测提升31%,对全新攻击向量仍保持90%以上准确率。
原文摘要 · Abstract (English)
Traditional security scanners fail when facing new attack patterns they haven't seen before. They rely on fixed rules and predetermined signatures, making them blind to novel threats. We present a fundamentally different approach: instead of memorizing specific attack patterns, we learn what makes systems genuinely secure. Our key insight is simple yet powerful: context determines vulnerability. A SQL query that's safe in one environment becomes dangerous in another. By modeling this context-vulnerability relationship, we achieve something remarkable: our system detects attacks it has never seen before. We introduce context-aware verification that learns from genuine system behavior. Through reconstruction learning on secure systems, we capture their essential characteristics. When an unknown attack deviates from these patterns, our system recognizes it, even without prior knowledge of that specific attack type. We prove this capability theoretically, showing detection rates improve exponentially with context information I(W;C). Our framework combines three components: (1) reconstruction learning that models secure behavior, (2) multi-scale graph reasoning that aggregates contextual clues, and (3) attention mechanisms guided by reconstruction differences. Extensive experiments validate our approach: detection accuracy jumps from 58 percent to 82 percent with full context, unknown attack detection improves by 31 percent, and our system maintains above 90 percent accuracy even against completely novel attack vectors.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。