v.

Case study
_ Kt qu t c khi chy MaxMinCoverage IDS v MaxProperty IDS trn mt
smart meter.

RQ1 (Detection): MaxMinCoverage IDS v MaxProperty IDS c th pht hin

cc kiu tn cng no?
RQ2(Relationship between estimated coverage and attack detection):
khc bit gia MaxMinCoverage IDS v MaxProperty IDS at runtime so vi
estimated at design time.
RQ3(nh hng ca vic tng b nh trong IDS): Vic tng b nh nh hng
nh th no ln detection rate ca MaxMinCoverage IDS v MaxProperty
IDS.
RQ4(Performance): Performance ca ca MaxMinCoverage IDS v
MaxProperty IDS trong h thng.

A. Chun b
S dng SEGMeter kho st.

B. Th nghim
S dng fault injection m phng c th l code mutation.

Fault injection l mt k thut dng ci thin code coverage.

Code coverage l mt n v o. Ch s cng cao th t l bug cng nh.
Code mutation l lm thay i mt s c tnh ca cu trc h thng t code ban
u nhm mc ch tm ra l hng h thng.
Th nghim to ra 226 mutations nhm ph hoi security ca h thng. Kt qu
c phn thnh 7 nhm

C. Kt qu
RQ1(Detection): detection =

number of detected attacks

total number of injected attacks

x 100

Mc tiu ca MaxMinCoverage IDS l lm tng ti a ch s property coverage nh

nht trong s cc security property.
Da vo kt qu trn ta thy detection rate nh nht l 70%, trong khi detection
rate trung bnh l 79.5%. Nh vy khc bit ch c 9.5%.

Mc tiu ca MaxProperty IDS l lm tng ti a s lng property c

property coverage 100%. y l 5 properties.
RQ2(Mi quan h gia l thuyt so vi thc t):

 chnh xc nh nht l 89%, trung bnh l 97%.

Thc t cho kt qu st vi l thuyt.

Ch c 1 property < 100% (c th l 77%). Nguyn nhn l do nhng gi tr

hng s bo m cho property ny cn rt nhiu b nh so vi nhng
property khc, m b nh c gii hn nn kt qu b gim.
RQ3(Tng b nh):
kho st, xy dng IDS s dng b nh 2MB v b nh 1MB.
2MB MaxMinCoverage IDS:

Kt qu cho thy detection rate trung bnh gim ch cn 44.3% do b nh

gim. Tuy nhin chnh xc trung bnh l 92% cho thy estimate
coverage rt gn so vi runtime.
2MB MaxProperty IDS:

Kt qu cho thy bo m 100% detection cho 3 security properties,

accuracy 93%.
1MB:
MaxMinCoverage IDS: detection rate trung bnh ch cn 19.8%
MaxProperty IDS: 100% detection ch 1 property.
RQ4(Performance overhead):

T cng nh th IDS pht hin tn cng cng nhanh.

Performance overhead cng cao th b nh chim cng nhiu.
T = 10s => performance overhead < 7%.
T < 1s => performance overhead cao.
T > 10s => khng thay i nhiu so vi T = 10s.
Kt lun chn T = 10s.
VI. Tho lun:
B nh hn ch:
Kt qu cho thy b nh hn ch dn ti vic gim ng k coverage.
Trong trng hp ny, k thut vn hu dng. C th l h thng bo v
mt s thnh phn, do ngi dng c th bit c nhng thnh phn
no khng c bo v c nhng bin php khc phc (code haderning
techniques hoc cm xem code ca mt s thnh phn trong h thng).
Hn ch:
Bi vit ny gi s cc gi tr hng s c u tin nh nhau. Tuy nhin
trong thc t mt vi gi tr s quan trng hn nhng gi tr cn li.
Cc kiu tn cng cng c gi s c tn sut xut hin nh nhau. Do vy
kt qu s khc so vi thc t.