NIST Technical Note 2111: An Empirical Study on Flow-based Botnet Attacks Prediction

こんにちは、丸山満彦です。

NISTがボット攻撃を予測することを目的とした研究のホワイトペーパーを公開していますね。

C2トラフィックの包括的なメトリクスを測定し、そのメトリクスの時系列データを攻撃データと関連づけて自動ラベリングすることで、ボットネットの攻撃予測を実証的かつ新規に分析したようで、実証した手法は、ボットネットによるスパムメールの増加を0.767の精度で予測することに成功したようです。ボットネット対策がさらに進むと良いですね。。。

● NIST -ITL

・2020.10.22 (updates) An Empirical Study on Flow-based Botnet Attacks Prediction: NIST Technical Note 2111

・2020.10.22 (publications) White Paper NIST Technical Note (TN) 2111 An Empirical Study on Flow-based Botnet Attacks Prediction

・[PDF]  White Paper

---

Abstract

There is a smart grid messaging framework known as an Open Field Message Bus (OpenFMB), which was ratified by the North American Energy Standards Board (NAESB) in March 2016 and has been released as NAESB RMQ.26, Open Field Message Bus (OpenFMB) Model Business Practices. OpenFMB focuses on describing a publish-and-subscribe model of communication for smart grid devices to enable efficient communication of data. Subsequent analysis of OpenFMB and its possible implementations will focus on threat analyses of the framework, implementations, cybersecurity recommendations, and a proof of concept implementation of OpenFMB. The OpenFMB framework is being explored as a way to implement publish-subscribe communications between smart grid network nodes. This paper focuses on the cybersecurity risk implications of deployments and a proof of concept implementation of OpenFMB.

---

Conclusion a Table of Contents

1. Introduction
2. Methodology
2.1. Measurement
2.2. Labeling
2.3. Prediction
3. Experimental Evaluation
3.1. Dataset
3.2. Results and Analysis
4. Related Work
5. Conclusion and Future Direction
References

List of Figures
Figure 1: Key idea in typical bot communication pattern
Figure 2: Example of labeling
Figure 3: Model
Figure 4: Accuracy transition
Figure 5: Contribution of metric and timestep 9

List of Tables
Table 1: C2 metrics
Table 2: Dataset
Table 3: Results of prediction

---