Accurate threat hunting in industrial internet of things edge devices  

作　　者：Abbas Yazdinejad Behrouz Zolfaghari Ali Dehghantanha Hadis Karimipour Gautam Srivastava Reza M.Parizi 

机构地区：[1]Cyber Science Lab,School of Computer Science,University of Guelph,Ontario,Canada [2]Department of Electrical and Software Engineering,University of Calgary,Alberta,Canada [3]Department of Mathematics and Computer Science,Brandon University,Brandon,Canada [4]College of Computing and Software Engineering,Kennesaw State University,GA,USA [5]Research Center for Interneural Computing,China Medical University,Taichung,Taiwan,China [6]Department of Computer Science and Mathematics,Lebanese American University,Beirut,1102,Lebanon

出　　处：《Digital Communications and Networks》2023年第5期1123-1130,共8页数字通信与网络（英文版）

摘　　要：Industrial Internet of Things(IIoT)systems depend on a growing number of edge devices such as sensors,controllers,and robots for data collection,transmission,storage,and processing.Any kind of malicious or abnormal function by each of these devices can jeopardize the security of the entire IIoT.Moreover,they can allow malicious software installed on end nodes to penetrate the network.This paper presents a parallel ensemble model for threat hunting based on anomalies in the behavior of IIoT edge devices.The proposed model is flexible enough to use several state-of-the-art classifiers as the basic learner and efficiently classifies multi-class anomalies using the Multi-class AdaBoost and majority voting.Experimental evaluations using a dataset consisting of multi-source normal records and multi-class anomalies demonstrate that our model outperforms existing approaches in terms of accuracy,F1 score,recall,and precision.

关 键 词：IIoT Threat hunting Edge devices Multi-class anomalies Ensemble methods 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]