X-IIoTID: A Connectivity- and Device-agnostic Intrusion Dataset for Industrial Internet of Things
收藏资源简介：
Industrial Internet of Things (IIoTs) are high-value cyber targets due to the nature of the devices and connectivity protocols they deploy. They are easy to compromise and, as they are connected on a large scale with high-value data content, the compromise of any single device can extend to the whole system and disrupt critical functions. There are various security solutions that detect and mitigate intrusions. However, as they lack the capability to deal with an IIoT's co-existing heterogeneity and interoperability, developing new universal security solutions to fit its requirements is critical. This is challenging due to the scarcity of accurate data about IIoT systems' activities, connectivities and attack behaviors. In addition, owing to their multi-platform connectivity protocols and multi-vendor devices, collecting and creating such data is also challenging. To tackle these issues, we propose a holistic approach for generating an appropriate intrusion dataset for an IIoT called X-IIoTID, connectivity- and device-agnostic intrusion dataset for fitting the heterogeneity and interoperability of IIoT systems. It includes the behaviors of new IIoT connectivity protocols, activities of recent devices, diverse attack types and scenarios, and various attack protocols. It defines an attack taxonomy and consists of multi-view features, such as network traffic, host resources, logs and alerts. X-IIoTID is evaluated using popular machine and deep learning algorithms and compared with eighteen intrusion datasets to verify its novelty.
工业物联网（Industrial Internet of Things, IIoT）因其所部署的设备与连接协议特性，成为高价值的网络攻击目标。此类系统易遭入侵，且由于其大规模组网并承载高价值数据内容，单台设备的入侵可波及整个系统，进而中断关键业务功能。目前已有多种可检测并缓解入侵行为的安全解决方案，但现有方案难以适配工业物联网共存的异构性与互操作性需求，因此开发契合其特性的通用安全解决方案至关重要。然而，由于缺乏关于工业物联网系统活动、连接情况与攻击行为的精准数据，这一目标极具挑战性。此外，由于其采用多平台连接协议与多厂商设备，收集并构建此类数据集同样困难重重。为解决上述问题，本文提出一种面向工业物联网的入侵数据集构建整体方案，所生成的X-IIoTID数据集是一款适配工业物联网异构性与互操作性的、与连接方式和设备无关的入侵数据集。该数据集涵盖新型工业物联网连接协议的行为特征、最新设备的活动信息、多样的攻击类型与场景，以及各类攻击协议。其定义了攻击分类体系，并包含多视图特征，例如网络流量、主机资源、日志与告警信息。本文采用主流机器学习与深度学习算法对X-IIoTID进行评估，并与18款现有入侵数据集进行对比，以验证其创新性。
