ハッカーが軍用機の乗っ取りを試みる可能性、サイバーシャッフルで止められるか？(Hackers could try to take over a military aircraft; can a cyber shuffle stop them?)

サンディアとパデュー大学は、それを破るために訓練されたアルゴリズムに対してサイバー防衛をテストするために提携 Sandia, Purdue team up to test cyberdefense against an algorithm trained to break it

2023-02-27 サンディア国立研究所(SNL)

＜関連情報＞

• https://newsreleases.sandia.gov/moving_target/
• https://ieeexplore.ieee.org/document/10015577

アドレスランダム化サイバーディフェンスの機械学習ベースのレジリエンステスト Machine Learning Based Resilience Testing of an Address Randomization Cyber Defense

Ganapathy Mani,Marina Haliem,Bharat Bhargava,Indu Manickam,Kevin Kochpatcharin,Myeongsu Kim,Eric Vugrin,Weichao Wang,Chris Jenkins,Pelin Angin,Meng Yu
IEEE Transactions on Dependable and Secure Computing  Published:11 January 2023
DOI:https://doi.org/10.1109/TDSC.2023.3234561

Abstract

Moving target defenses (MTDs) are widely used as an active defense strategy for thwarting cyberattacks on cyber-physical systems by increasing diversity of software and network paths. Recently, machine Learning (ML) and deep Learning (DL) models have been demonstrated to defeat some of the cyber defenses by learning attack detection patterns and defense strategies. It raises concerns about the susceptibility of MTD to ML and DL methods. In this paper, we analyze the effectiveness of ML and DL models when it comes to deciphering MTD methods and ultimately evade MTD-based protections in real-time systems. Specifically, we consider a MTD algorithm that periodically randomizes address assignments within the MIL-STD-1553 protocol—a military standard serial data bus. Two ML and DL-based tasks are performed on MIL-STD-1553 protocol to measure the effectiveness of the learning models in deciphering the MTD algorithm: 1) determining whether there is an address assignments change i.e. whether the given system employs a MTD protocol and if it does 2) predicting the future address assignments. The supervised learning models (random forest and k-nearest neighbors) effectively detected the address assignment changes and classified whether the given system is equipped with a specified MTD protocol. On the other hand, the unsupervised learning model (K-means) was significantly less effective. The DL model (long short-term memory) was able to predict the future addresses with varied effectiveness based on MTD algorithm’s settings.