Granger因果关系检验在攻击检测中的应用研究

在时态数据挖掘框架下,对基于Granger因果关系检验的攻击检测方法进行了研究。通过计算多个前兆输入时间序列与给定异常输出时间序列之间的因果关联程度,可从描述网络系统安全状态的多元时间序列数据集中检测出网络攻击行为的前兆,进而形成可供实际检测和预警使用的高置信度前兆规则和因果规则。对所提方法的正确性和精度进行了验证,并在设计的攻击检测与预警原型系统中对其进行了应用分析。

Application research based on Granger causality test for attack detection

The method for attack detection based on Granger Causality Test(GCT) within the framework of temporal data mining was investigated. Through computing causality between a lot of precursors from input time series and a given anomaly from output time series, the method can be used to detect the precursor from datasets containing multivariate time series related to different security regimes of network system, and then produces the precursor rules and causality rules for actual attack detection and early warning with high confidence. Several experiments were conducted to verify the accuracy and precision of the proposed method, and finally its application analysis in attack detection and early warning prototype system was presented.