共查询到17条相似文献,搜索用时 187 毫秒
1.
基于隐马尔可夫模型的用户行为异常检测新方法 总被引:2,自引:0,他引:2
提出一种基于隐马尔可夫模型的用户行为异常检测方法,主要用于以shell命令为审计数据的主机型入侵检测系统。与Lane T提出的检测方法相比,所提出的方法改进了对用户行为模式和行为轮廓的表示方式,在HMM的训练中采用了运算量较小的序列匹配方法,并基于状态序列出现概率对被监测用户的行为进行判决。实验表明,此方法具有很高的检测准确度和较强的可操作性。 相似文献
2.
我们利用隐马尔可夫模型来描述特权进程正常运行时局部系统调用之间存在的规律性.具体方法是将UNIX特权程序的系统调用轨迹通过隐马尔可夫模型处理得到系统状态转移序列,再经滑窗后得到系统状态转移短序列.初步的实验证明这样得到的系统状态转移短序列比TIDE方法提出的系统调用短序列能更加简洁和稳定地表示系统的正常状态,采用这种状态短序列建立的正常轮廓库比较小,而且对训练数据的不完整性不太敏感.在同等的训练数据下,检测时本方法比TIDE方法的检测速度快,虚警率低. 相似文献
3.
4.
5.
6.
7.
基于改进关联规则的网络入侵检测方法的研究 总被引:1,自引:1,他引:1
研究关联规则的高效挖掘算法对于提高入侵检测的准确性和时效性具有非常重要的意义.针对现行的入侵检测方法建立的正常模式和异常模式不够准确、完善,容易造成误警或漏警的问题,本文将改进后的关联规则挖掘算法-XARM和关联规则增量更新算法-SFUP应用于网络入侵检测,提出了新的入侵检测方法,该方法通过挖掘训练审计数据中的频繁项集建立系统和用户的正常行为模型以及入侵行为模型. 相似文献
8.
9.
论文提出了一个基于Windows系统调用序列检测的异常检测模型,并在原有的系统调用序列串算法的基础上引入了系统调用参数以及系统调用虚地址空间来对程序行为进行精确分析。 相似文献
10.
异常检测是目前入侵检测系统(IDS)研究的主要方向。该文提出一种基于shell命令和Markov链模型的用户行为异常检测方法,该方法利用一阶齐次Markov链对网络系统中合法用户的正常行为进行建模,将Markov链的状态与用户执行的shell命令联系在一起,并引入一个附加状态;Markov链参数的计算中采用了运算量较小的命令匹配方法;在检测阶段,基于状态序列的出现概率对被监测用户当前行为的异常程度进行分析,并提供了两种可选的判决方案。文中提出的方法已在实际入侵检测系统中得到应用,并表现出良好的检测性能。 相似文献
11.
TIAN Xin-guang GAO Li-zhi SUN Chun-lai DUAN Mi-yi ZHANG Er-yang.School of Electronic Science Engineering National University of Defense Technology Changsha P.R. China .Department of Electronic Engineering Tsinghua University Beijing P.R. China .Research Institute of Beijing Capitel Group Corporation Beijing P.R. China .Institute of Computing Technology Beijing Jiaotong University Beijing P.R. China 《中国邮电高校学报(英文版)》2006,13(2):61-78
1Introduction Intrusiondetectiontechniquescanbecategorizedinto misusedetectionandanomalydetection.Misusedetec tionsystemsmodelattacksasspecificpatterns,anduse thepatternsofknownattackstoidentifyamatchedac tivityasanattackinstance.Anomalydetectionsystems u… 相似文献
12.
一种新的基于Markov链模型的用户行为异常检测方法 总被引:3,自引:0,他引:3
提出一种新的基于Markov链模型的用户行为异常检测方法。该方法利用一阶齐次Markov链对网络系统中合法用户的正常行为进行建模,将Markov链的状态同用户执行的shell命令序列联系在一起,并引入一个附加状态;在检测阶段,基于状态序列的出现概率对用户当前行为的异常程度进行分析,并根据Markov链状态的实际含义和用户行为的特点, 采用了较为特殊的判决准则。与Lane T提出的基于隐Markov模型的检测方法相比,该方法的计算复杂度较低,更适用于在线检测。而同基于实例学习的检测方法相比,该方法则在检测准确率方面具有较大优势。文中提出的方法已在实际入侵检测系统中得到应用,并表现出良好的检测性能。 相似文献
13.
We presented a novel framework for automatic behavior clustering and unsupervised anomaly detection in a large video set. The framework consisted of the following key components: 1) Drawing from natural language processing, we introduced a compact and effective behavior representation method as a stochastic sequence of spatiotemporal events, where we analyzed the global structural information of behaviors using their local action statistics. 2) The natural grouping of behavior patterns was discovered through a novel clustering algorithm. 3) A run-time accumulative anomaly measure was introduced to detect abnormal behavior, whereas normal behavior patterns were recognized when sufficient visual evidence had become available based on an online Likelihood Ratio Test (LRT) method. This ensured robust and reliable anomaly detection and normal behavior recognition at the shortest possible time. Experimental results demonstrated the effectiveness and robustness of our approach using noisy and sparse data sets collected from a real surveillance scenario. 相似文献
14.
Fedor Chernogorov Sergey Chernov Kimmo Brigatti Tapani Ristaniemi 《Wireless Networks》2016,22(6):2029-2048
This article presents an automatic malfunction detection framework based on data mining approach to analysis of network event sequences. The considered environment is long term evolution (LTE) of Universal Mobile Telecommunications System with sleeping cell caused by random access channel failure. Sleeping cell problem means unavailability of network service without triggered alarm. The proposed detection framework uses N-gram analysis for identification of abnormal behavior in sequences of network events. These events are collected with minimization of drive tests functionality standardized in LTE. Further processing applies dimensionality reduction, anomaly detection with K-Nearest Neighbors, cross-validation, postprocessing techniques and efficiency evaluation. Different anomaly detection approaches proposed in this paper are compared against each other with both classic data mining metrics, such as F-score and receiver operating characteristic curves, and a newly proposed heuristic approach. Achieved results demonstrate that the suggested method can be used in modern performance monitoring systems for reliable, timely and automatic detection of random access channel sleeping cells. 相似文献
15.
一种基于隐马尔可夫模型的IDS异常检测新方法 总被引:3,自引:1,他引:3
提出一种新的基于隐马尔可夫模型的异常检测方法,主要用于以shell命令或系统调用为原始数据的IDS。此方法对用户(或程序)行为建立特殊的隐马尔可夫模型,根据行为模式所对应的序列长度对其进行分类,将行为模式类型同隐马尔可夫模型的状态联系在一起,并引入一个附加状态。由于模型中各状态对应的观测值集合互不相交,模型训练中采用了运算量较小的的序列匹配方法,与传统的Baum-Welch算法相比,大大减小了训练时间。根据模型中状态的实际含义,采用了基于状态序列出现概率的判决准则。利用UNIX平台上用户shell命令数据进行的实验表明,此方法具有很高的检测准确性,其可操作性也优于同类方法。 相似文献
16.
采用序列模式挖掘算法构建电网异常检测模型,能够更好地表现电网异常行为。基于此进行了电网异常检测建模方法的研究,并提出了一个基于模糊序列模式的电网异常检测模型。通过理论分析和仿真实验证明,提出的模型不仅具有检测异常行为的实际能力,而且检测效率和检测性能都得到了很大的提高。 相似文献
17.
Current intrusion detection systems are mostly for detecting external attacks,but sometimes the internal staff may bring greater harm to organizations in information security.Traditional insider threat detection methods of-ten do not combine the behavior of people with business activities,making the threat detection rate to be improved.An insider threat detection system based on business process mining from two aspects was proposed,the implementation of insider threats and the impact of threats on system services.Firstly,the normal control flow model of business ac-tivities and the normal behavior profile of each operator were established by mining the training log.Then,the actual behavior of the operators was compared with the pre-established normal behavior contours during the operation of the system,which was supplemented by control flow anomaly detection and performance anomaly detection of business processes,in order to discover insider threats.A variety of anomalies were defined and the corresponding detection algorithms were given.Experiments were performed on the ProM platform.The results show the designed system is effective. 相似文献