Threat Hunting Architecture for Electric Internet of Things: Redundancy, Diversity, Dynamism and Machine Learning

The Electric Internet of Things (E-IoT) system, as a critical information infrastructure, has become a primary target for cyber attackers, resulting in significant consequences upon compromise. Consequently, threat hunting within the E-IoT system plays a crucial role in detecting cyber threats and preventing cyber attacks. In recent decades, machine learning (ML)-based threat hunting methods have proliferated, aiming to achieve better performance and enhance security. These methods focus on analyzing the features of E-IoT equipment and predicting whether they are under attack. However, they often fall short when dealing with attacks that manipulate the output of equipment and compromise other connected devices without altering their configuration information or internal data. This paper first classifies cyber attacks into two categories: the destructive attack and the latent attack, illustrating that traditional ML-based threat hunting methods are primarily effective against the former. Subsequently, we propose the Redundancy Diversity Dynamism Machine Learning (RDD&ML) threat hunting architecture for the E-IoT system and prove that the RDD&ML architecture enhances the system's reliability. Moreover, the proposed architecture exhibits superiority over traditional ML-based methods when confronting unknown threats or attacks, as it does not rely on prior knowledge of the adversary. Experimental results on real dataset demonstrate that the RDD&ML architecture enhances the threat hunting performance of the E-IoT system.