首先简要介绍了 CIMS系统的体系结构和 L on Works的技术特点 ,以及在 CIMS系统中采用 L on Works技术所具有的优势。对基于 L on Works的 Host- based节点与 Neuron Chip- hosted节点进行了比较 ,并给出实例展示了该系统由单片机80 C19...首先简要介绍了 CIMS系统的体系结构和 L on Works的技术特点 ,以及在 CIMS系统中采用 L on Works技术所具有的优势。对基于 L on Works的 Host- based节点与 Neuron Chip- hosted节点进行了比较 ,并给出实例展示了该系统由单片机80 C196KB为主处理器 Neuron,芯片 MC14312 0为从处理器 ;两处理器协同工作 ,主处理器采样控制 ,从处理器负责通信。以Host- based节点为基础的 CIMS系统。展开更多
With the continuous expansion of digital infrastructures,malicious behaviors in host systems have become increasingly sophisticated,often spanning multiple processes and employing obfuscation techniques to evade detec...With the continuous expansion of digital infrastructures,malicious behaviors in host systems have become increasingly sophisticated,often spanning multiple processes and employing obfuscation techniques to evade detection.Audit logs,such as Sysmon,offer valuable insights;however,existing approaches typically flatten event sequences or rely on generic graph models,thereby discarding the natural parent-child process hierarchy that is critical for analyzing multiprocess attacks.This paper proposes a structure-aware threat detection framework that transforms audit logs into a unified two-dimensional(2D)spatio-temporal representation,where process hierarchy is modeled as the spatial axis and event chronology as the temporal axis.In addition,entropy-based features are incorporated to robustly capture obfuscated and non-linguistic strings,overcoming the limitations of semantic embeddings.The model’s performance was evaluated on publicly available datasets,achieving competitive results with an accuracy exceeding 95%and an F1-score of at least 0.94.The proposed approach provides a promising and reproducible solution for detecting attacks with unknown indicators of compromise(IoCs)by analyzing the relationships and behaviors of processes recorded in large-scale audit logs.展开更多
文摘首先简要介绍了 CIMS系统的体系结构和 L on Works的技术特点 ,以及在 CIMS系统中采用 L on Works技术所具有的优势。对基于 L on Works的 Host- based节点与 Neuron Chip- hosted节点进行了比较 ,并给出实例展示了该系统由单片机80 C196KB为主处理器 Neuron,芯片 MC14312 0为从处理器 ;两处理器协同工作 ,主处理器采样控制 ,从处理器负责通信。以Host- based节点为基础的 CIMS系统。
基金supported by the Nuclear Safety Research Program through Korea Foundation of Nuclear Safety(KoFONS)using the financial resource granted by the Nuclear Safety and Security Commission(NSSC)of the Republic of Korea(Grant number:2106061,50%)supported by the Institute of Information&Communications Technology Planning&Evaluation(IITP)grant funded by the Korea government(MSIT)(RS-2025-25394739,Development of Security Enhancement Technology for Industrial Control Systems Based on S/HBOM Supply Chain Protection,50%).
文摘With the continuous expansion of digital infrastructures,malicious behaviors in host systems have become increasingly sophisticated,often spanning multiple processes and employing obfuscation techniques to evade detection.Audit logs,such as Sysmon,offer valuable insights;however,existing approaches typically flatten event sequences or rely on generic graph models,thereby discarding the natural parent-child process hierarchy that is critical for analyzing multiprocess attacks.This paper proposes a structure-aware threat detection framework that transforms audit logs into a unified two-dimensional(2D)spatio-temporal representation,where process hierarchy is modeled as the spatial axis and event chronology as the temporal axis.In addition,entropy-based features are incorporated to robustly capture obfuscated and non-linguistic strings,overcoming the limitations of semantic embeddings.The model’s performance was evaluated on publicly available datasets,achieving competitive results with an accuracy exceeding 95%and an F1-score of at least 0.94.The proposed approach provides a promising and reproducible solution for detecting attacks with unknown indicators of compromise(IoCs)by analyzing the relationships and behaviors of processes recorded in large-scale audit logs.
