Security attacks are rising, as evidenced by the number of reported vulnerabilities. Among them, unknown attacks, including new variants of existing attacks, technical blind spots or previously undiscovered attacks, challenge enduring security. This is due to the limited number of techniques that diagnose these attacks and enable the selection of adequate security controls. In this paper, we propose an automated technique that detects and diagnoses unknown attacks by identifying the class of attack and the violated security requirements, enabling the selection of adequate security controls. Our technique combines anomaly detection to detect unknown attacks with abductive reasoning to diagnose them. We first model the behaviour of the smart home and its requirements as a logic program in Answer Set Programming (ASP). We then apply Z-Score thresholding to the anomaly scores of an Isolation Forest trained using unlabeled data to simulate unknown attack scenarios. Finally, we encode the network anomaly in the logic program and perform abduction by refutation to identify the class of attack and the security requirements that this anomaly may violate. We demonstrate our technique using a smart home scenario, where we detect and diagnose anomalies in network traffic. We evaluate the precision, recall and F1-score of the anomaly detector and the diagnosis technique against 18 attacks from the ground truth labels provided by two datasets, CICIoT2023 and IoT-23. Our experiments show that the anomaly detector effectively identifies anomalies when the network traces are strong indicators of an attack. When provided with sufficient contextual data, the diagnosis logic effectively identifies true anomalies, and reduces the number of false positives reported by anomaly detectors. Finally, we discuss how our technique can support the selection of adequate security controls.

翻译：安全攻击事件不断增多，已报告漏洞的数量即为明证。其中，未知攻击（包括现有攻击的新变体、技术盲点或先前未发现的攻击）对持久安全构成挑战。这主要是由于能够诊断此类攻击并支持选择适当安全控制措施的技术手段有限。本文提出一种自动化技术，通过识别攻击类别及被违反的安全要求来检测和诊断未知攻击，从而支持选择恰当的安全控制措施。该技术将用于检测未知攻击的异常检测与用于诊断的溯因推理相结合。我们首先使用答案集编程（ASP）将智能家居行为及其安全要求建模为逻辑程序，随后对基于无标签数据训练的孤立森林所生成的异常分数应用Z分数阈值法，以模拟未知攻击场景。最后，我们将网络异常编码至逻辑程序中，通过反证法执行溯因推理，以识别攻击类别及该异常可能违反的安全要求。我们在智能家居场景中演示了该技术，实现了对网络流量异常的检测与诊断。基于CICIoT2023和IoT-23两个数据集提供的真实标签，我们针对18类攻击评估了异常检测器与诊断技术的精确率、召回率和F1分数。实验表明：当网络轨迹成为攻击的强指示特征时，异常检测器能有效识别异常；在获得充分上下文数据的情况下，诊断逻辑能有效识别真实异常，并减少异常检测器报告的误报数量。最后，我们讨论了该技术如何支持选择适当的安全控制措施。