Network Security Inference Method Based on Dempster-Shafer Theory

doi:10.16183/j.cnki.jsjtu.2021.S2.012

Abstract

Abstract:

The network environment of the edge layer of the Internet of Things in power systems (IOTIPS) is complex in an open environment, and the security threats are diverse and dynamic. It is difficult for the traditional network security system based on firewall to effectively deal with the emerging security problems of the IOTIPS. This paper uses the data-driven idea to dynamically judge the network behavior of edge devices. Based on the characteristics of the IOTIPS, by using the three dimensions of network log, domain name generated by domain generation algorithm, and network traffic as criteria, a basic probability assignment method based on confusion matrix is proposed. Multi-source information fusion is performed by using the Dempster-Shafer theory, and the network security of IOTIPS is distinguished.

Key words: Internet of Things in power systems (IOTIPS), Dempster-Shafer theory, network security, evidence fusion

CLC Number:

TM76

WU Nan, CHENG Zhetao, DU Liang, SHEN Yingping. Network Security Inference Method Based on Dempster-Shafer Theory[J]. Journal of Shanghai Jiao Tong University, 2021, 55(S2): 77-81.

Figures/Tables 7

Tab.1

Tab.2

Tab.3

Fig.1

Tab.4

Tab.5

Tab.6

References 10

[1]	周峰, 周晖, 刁赢龙. 泛在电力物联网智能感知关键技术发展思路[J]. 中国电机工程学报, 2020, 40(1): 70-82.
	ZHOU Feng, ZHOU Hui, DIAO Yinglong. Development of intelligent perception key technology in the ubiquitous Internet of Things in electricity[J]. Proceedings of the CSEE, 2020, 40(1): 70-82.
[2]	吕志宁, 胡子珩, 宁柏锋, 等. 针对电力系统的物联网需求攻击研究进展与发展趋势[J]. 南方电网技术, 2020, 14(1): 24-30.
	LÜ Zhining, HU Ziheng, NING Baifeng, et al. Review of research progress and development trend of Internet of Things demand attack on power system[J]. Southern Power System Technology, 2020, 14(1): 24-30.
[3]	化存卿. 物联网安全检测与防护机制综述[J]. 上海交通大学学报, 2018, 52(10): 1307-1313.
	HUA Cunqing. A survey of security detection and protection for Internet of Things[J]. Journal of Shanghai Jiao Tong University, 2018, 52(10): 1307-1313.
[4]	文志诚, 陈志刚, 唐军. 基于聚类分析的网络安全态势评估方法[J]. 上海交通大学学报, 2016, 50(9): 1407-1414.
	WEN Zhicheng, CHEN Zhigang, TANG Jun. Network security assessment method based on cluster analysis[J]. Journal of Shanghai Jiao Tong University, 2016, 50(9): 1407-1414.
[5]	KIM Y, KOLESNIKOV V, KIM H, et al. SSTP: A scalable and secure transport protocol for smart grid data collection[C]// 2011 IEEE International Conference on Smart Grid Communications. Brussels, Belgium: IEEE, 2011: 161-166.
[6]	DE RANGO F, POTRINO G, TROPEA M, et al. Energy-aware dynamic Internet of Things security system based on elliptic curve cryptography and message queue telemetry transport protocol for mitigating replay attacks[J]. Pervasive and Mobile Computing, 2020, 61:101105. doi: 10.1016/j.pmcj.2019.101105 URL
[7]	SHAFER G. A mathematical theory of evidence[M]. Princeton: Princeton University Press, 1976: 23-29.
[8]	蒋雯, 邓鑫洋. D-S证据理论: 信息建模与应用[M]. 北京: 科学出版社, 2018: 8-17.
	JIANG Wen, DENG Xinyang. Dempster-Shafer evidence theory: Information modeling and application[M]. Beijing: Science Press, 2018: 8-17.
[9]	MUKKAMALA S, SUNG A, ABRAHAM A. Cyber security challenges: Designing efficient intrusion detection systems and antivirus tools[J]. Enhancing Computer Security with Smart Technology, 2005, 3(2): 125-163.
[10]	王洪勉, 孙慧, 郑利斌, 等. 泛在电力物联网智联单元设计与实现[J]. 供用电, 2019, 36(6): 5-9.
	WANG Hongmian, SUN Hui, ZHENG Libin, et al. Design and implementation of wisdom unit in the ubiquitous Internet of Things in electricity[J]. Distribution & Utilization, 2019, 36(6): 5-9.

方向	协议类型	接口物理形态
北向接口	以太网	RJ45
	无线公网	SMA同轴
	电力无线专网	SMA同轴
	NB-IoT	SMA同轴
	eMTC	SMA同轴
南向接口	Modbus(IP)	RJ45
	Modbus(RS232)	RJ45/凤凰端子
	Modbus(RS485)	RJ45/凤凰端子
	LoRa	SMA同轴
	ZigBee	SMA同轴
	电力线载波	凤凰端子
	微功率无线	SMA同轴

实际分类	预测分类
实际分类	Backdoor	Injection	Normal	Password	Scanning	XSS
Backdoor	0.9948	0	0.0052	0	0	0
Injection	0	0.9996	0.0004	0	0	0
Normal	0	0	1	0	0	0
Password	0	0	0.0008	0.9992	0	0
Scanning	0	0	0.0302	0	0.9698	0
XSS	0	0	0.0069	0	0	0.9931

编号	分类器输出的威胁类别	PC_α(ω_i)
1	Backdoor	0.9948
2	Injection	0.9996
3	Normal	1
4	Password	0.9992
5	Scanning	0.9698
6	XSS	0.9931

信息源	信度函数值			判别结果
信息源	Normal	Scanning	Backdoor	判别结果
网络日志	0.8103	0.1707	0.0205	Normal
访问域名	1	0	0	Normal
网络流量	0.9	0.05	0.05	Normal
融合	0.9516	0.0475	0.0109	Normal

信息源	信度函数值			判别结果
信息源	Normal	Scanning	Backdoor	判别结果
网络日志	0.6404	0.2221	0.1371	Normal
访问域名	0	0.9281	0.072	Scanning
网络流量	0.7	0.15	0.15	Normal
融合	0.3102	0.5908	0.109	Scanning