The Internet of Battlefield Things (IoBT) will advance the operational
effectiveness of infantry units. However, this requires autonomous assets such
as sensors, drones, combat equipment, and uncrewed vehicles to collaborate,
securely share information, and be resilient to adversary attacks in contested
multi-domain operations. CAPD addresses this problem by providing a
context-aware, policy-driven framework supporting data and knowledge exchange
among autonomous entities in a battlespace. We propose an IoBT ontology that
facilitates controlled information sharing to enable semantic interoperability
between systems. Its key contributions include providing a knowledge graph with
a shared semantic schema, integration with background knowledge, efficient
mechanisms for enforcing data consistency and drawing inferences, and
supporting attribute-based access control. The sensors in the IoBT provide data
that create populated knowledge graphs based on the ontology. This paper
describes using CAPD to detect and mitigate adversary actions. CAPD enables
situational awareness using reasoning over the sensed data and SPARQL queries.
For example, adversaries can cause sensor failure or hijacking and disrupt the
tactical networks to degrade video surveillance. In such instances, CAPD uses
an ontology-based reasoner to see how alternative approaches can still support
the mission. Depending on bandwidth availability, the reasoner initiates the
creation of a reduced frame rate grayscale video by active transcoding or
transmits only still images. This ability to reason over the mission sensed
environment and attack context permits the autonomous IoBT system to exhibit
resilience in contested conditions.

提出了一种基于 CAPD 的 IoBT 本体论，其利用共享语义架构和后台知识集成，支持在战场上多个自主实体间的数据和知识交流。 在对抗情况下本体论能够处理信息和推理来提高运筹能力，具有抗击敌人行为和展示 IoBT 系统弹性的特点。

CAPD: 一种面向上下文、策略驱动的 IoBT 安全和弹性框架

CAPD: A Context-Aware, Policy-Driven Framework for Secure and Resilient IoBT Operations

The proliferation of interconnected battlefield information-sharing devices,
known as the Internet of Battlefield Things (IoBT), introduced several security
challenges. Inherent to the IoBT operating environment is the practice of
adversarial machine learning, which attempts to circumvent machine learning
models. This work examines the feasibility of cost-effective unsupervised
learning and graph-based methods for anomaly detection in the network intrusion
detection system setting, and also leverages an ensemble approach to supervised
learning of the anomaly detection problem. We incorporate a realistic
adversarial training mechanism when training supervised models to enable strong
classification performance in adversarial environments. The results indicate
that the unsupervised and graph-based methods were outperformed in detecting
anomalies (malicious activity) by the supervised stacking ensemble method with
two levels. This model consists of three different classifiers in the first
level, followed by either a Naive Bayes or Decision Tree classifier for the
second level. The model maintains an F1-score above 0.97 for malicious samples
across all tested level two classifiers. Notably, Naive Bayes is the fastest
level two classifier averaging 1.12 seconds while Decision Tree maintains the
highest AUC score of 0.98.

本文旨在探讨在 IoBT 的环境下，通过成本效益较高的无监督学习和基于图的方法来检测入侵网络系统中的异常情况，同时采用集成方法进行监督学习的异常检测，研究结果表明，采用两级的监督堆叠集成方法能更好地识别出恶意活动。