Towards Generating a Practical SUNBURST Attack Dataset for Network Attack Detection  

作　　者：Ehab AlMasri Mouhammd Alkasassbeh Amjad Aldweesh 

机构地区：[1]Princess Summaya University for Technology,Amman,Jordan [2]College of Computing and IT,Shaqra University,Shaqra,Saudi Arabia

出　　处：《Computer Systems Science & Engineering》2023年第11期2643-2669,共27页计算机系统科学与工程（英文）

摘　　要：Supply chain attacks,exemplified by the SUNBURST attack utilizing SolarWinds Orion updates,pose a growing cybersecurity threat to entities worldwide.However,the need for suitable datasets for detecting and anticipating SUNBURST attacks is a significant challenge.We present a novel dataset collected using a unique network traffic data collection methodology to address this gap.Our study aims to enhance intrusion detection and prevention systems by understanding SUNBURST attack features.We construct realistic attack scenarios by combining relevant data and attack indicators.The dataset is validated with the J48 machine learning algorithm,achieving an average F-Measure of 87.7%.Our significant contribution is the practical SUNBURST attack dataset,enabling better prevention and mitigation strategies.It is a valuable resource for researchers and practitioners to enhance supply chain attack defenses.In conclusion,our research provides a concise and focused SUNBURST attack dataset,facilitating improved intrusion detection and prevention systems.

关 键 词：SolarWinds orion software supply-chain-attack SUNBURSTattack solar gate UNC2452 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]