基於LightGBM 之補正 SPA 漏洞演算法;A LightGBM-Based Algorithm for Correcting Single-Packet Authorization Vulnerabilities

NCUIR > College of Electrical Engineering & Computer Science > Graduate Institute of Communication Engineering > Electronic Thesis & Dissertation > Item 987654321/99351

Please use this identifier to cite or link to this item: https://ir.lib.ncu.edu.tw/handle/987654321/99351

Title:	基於LightGBM 之補正 SPA 漏洞演算法;A LightGBM-Based Algorithm for Correcting Single-Packet Authorization Vulnerabilities
Authors:	王子權;Wang, Tzu-Chuan
Contributors:	通訊工程學系
Keywords:	零信任架構;軟體定義邊界;入侵偵測系統;特徵選取;DDoS偵測;Zero Trust Architecture;Software-Defined Perimeter;Intrusion Detection System;Feature Selection;DDoS Detection
Date:	2025-12-12
Issue Date:	2026-03-06 18:47:14 (UTC+8)
Publisher:	國立中央大學
Abstract:	隨著網路規模持續擴張，零信任架構（ZeroTrust Architecture, ZTA）成為現代企業防護的重要基礎，其中軟體定義邊界（Software-Defined Perimeter, SDP）以「先驗證、後連線」的策略有效降低外部攻擊面。然而，SDP的單一封包授權（SinglePacket Authorization, SPA）僅在連線建立前進行一次性驗證，對授權後可能出現的惡意行為與DDoS 攻擊仍缺乏偵測能力，形成其結構性的安全缺口。為補足此一限制，亟需導入基於流量行為的持續監測機制。行為式偵測通常仰賴機器學習模型；然而IoT流量具有高維度、高變異與噪聲敏感的特性，使模型容易受到冗餘特徵干擾而降低偵測效能。因此，需要能在高維度特徵空間中挑選出具代表性訊號的特徵選取方法，以提升模型的準確度與穩健性。基於此，本研究提出一套以灰狼最佳化演算法（GreyWolf Optimizer, GWO）結合LightGBM 的包裝式特徵選取方法，透過搜尋高維度流量特徵組合以挑選具辨識力的特徵子集，並建立可提升SDP授權後行為可視性的惡意流量偵測模型。實驗採用 CIC-IoT-2023 流量資料集，並於多種噪聲條件下評估方法的穩健性。結果顯示，本方法在DDoS 流量偵測表現上較多種對照組具有更佳的準確性。;As network environments continue to expand, the Zero Trust Architecture (ZTA) has become a fundamental security paradigm, while the Software-Defined Perimeter (SDP) mitigates external attack surfaces through its “authenticate-before-connect”principle. However, SDP’s Single Packet Authorization (SPA) performs only a one-time verifica tion prior to connection establishment, leaving it unable to detect malicious activities or DDoS attacks that may occur after authorization. This limitation highlights the need for behavior-based continuous monitoring within SDP-protected systems. Behavioral detection typically relies on machine learning models. Yet, IoT network traffic is characterized by high dimensionality, variability, and sensitivity to noise, which can degrade classifier performance when redundant or irrelevant features are present. Consequently, an effective feature selection mechanism is essential to identify the most discriminative features and improve both detection accuracy and robustness. Based on this motivation, this study proposes a wrapper-based feature selection method that integrates the Grey Wolf Optimizer (GWO) with LightGBM. The method explores the high-dimensional feature space to identify discriminative feature subsets and constructs a detection model that enhances SDP’s post-authorization visibility. Experi ments conducted on the CIC-IoT-2023 dataset under various noise conditions demonstrate that the proposed method achieves more accurate and consistent DDoS detection perfor mance compared with several baseline approaches.
Appears in Collections:	[Graduate Institute of Communication Engineering] Electronic Thesis & Dissertation

Files in This Item:

File	Description	Size	Format
index.html		0Kb	HTML	233	View/Open

社群 sharing

Loading...