用模块化组件快速构建实时入侵预测系统
A Modular Framework for Rapidly Building Intrusion Predictors
- 将入侵预测拆解为可复用模块，灵活组合
- 支持动态组装，实现实时攻击阶段识别
- 适合安全团队快速部署多类型攻击检测
本文研究基于统计学习方法的自动化入侵预测。重点是构建在线攻击预测器，实现实时检测攻击并识别攻击当前阶段。现有工作通常针对特定攻击类型和场景构建单一预测器，而MITRE框架中收录了数百种攻击类型，为每种训练独立预测器不可行。为此，本文提出一种模块化框架，可快速从可复用组件中组装在线攻击预测器。模块化设计使预测器在时效性与准确性间的权衡更可控，并可通过公开数据集训练与评估，展示多个模块化预测器实例。结果表明，有效预测器可在训练过程中动态从模块网络中组装而成。
原文摘要 · Abstract (English)
We study automated intrusion prediction in an IT system using statistical learning methods. The focus is on developing online attack predictors that detect attacks in real time and identify the current stage of the attack. While such predictors have been proposed in the recent literature, these works typically rely on constructing a monolithic predictor tailored to a specific attack type and scenario. Given that hundreds of attack types are cataloged in the MITRE framework, training a separate monolithic predictor for each of them is infeasible. In this paper, we propose a modular framework for rapidly assembling online attack predictors from reusable components. The modular nature of a predictor facilitates controlling key metrics like timeliness and accuracy of prediction, as well as tuning the trade-off between them. Using public datasets for training and evaluation, we provide many examples of modular predictors and show how an effective predictor can be dynamically assembled during training from a network of modular components.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。