资源描述：
《基于模式挖掘的用户行为异常检测》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。
1、第25卷第3期计算机学报Vol.25No.32002年3月CHINESEJ.COMPUTERSMar.2002基于模式挖掘的用户行为异常检测连一峰戴英侠王航(中国科学院研究生院信息安全国家重点实验室北京100039)摘要行为模式通常反映了用户的身份和习惯,该文阐述了针对Telnet会话中用户执行的shell命令,利用数据挖掘中的关联分析和序列挖掘技术对用户行为进行模式挖掘的方法,分析了传统的相关函数法在应用于序列模式比较时的不足,提出了基于递归式相关函数的模式比较算法,根据用户历史行为模式和当前行为模式的比较相似度来检测用户行为中的异常,最后给出了
2、相应的实验结果.关键词行为模式,数据挖掘,相似度,递归式相关函数中图法分类号:TP18AnomalyDetectionofUserBehaviorsBasedonProfileMiningLIANYi-FengDAIYing-XiaWANGHang(StateKeyLaboratoryofInformationSecurity,TheGraduateSchoolofChineseAcademyofSciences,Beijing100039)AbstractAnomalydetectionactsasthemajordirectionofresea
3、rchinintrusiondetection.De-tectinganomaliesinsystem/userbehaviorprofilescanhelpustodiscoverunknownattacks.ThecriticalproblemofAnomalyDetectionliesinhowtoconstructthenormalusageprofilesandhowtoperformprofilecomparison.Fortunately,researchersofColumbiaUniversitypointedoutafeasib
4、lesolutionforus:datamining.Theyalsopresentedsomeinspiringresultsofexperiments.Asakindofapplication-specificapproachfordata-processing,datamininghastheabilitytodis-coverhiddenknowledgefromlargevolumesofsecurityauditdata.Dataminingtechniques,in-cludingassociationanalysis,sequenc
5、emininganddataclassification,cangreatlyimprovethea-bilityofmininguserbehaviorprofileswhichusuallyreflectidentitiesandhabitsofusers.WeuseBro,astand-alonesystemfordetectingnetworkintrudersinreal-time,toextractsiellcommandspresentedbyusersduringtelnetsessions.Commandsareformatted
6、andorganizedintoauditrecords.Afterthat,theapriorialgorithmandtheslidingwindowdivisionalgorithmareintro-ducedtominebehaviorprofileswhicharecomposedofassociationrulesandsequencepatternsfromtheseauditrecords.Afterdemonstratingthedefectoftraditionalcomparisonalgorithmwhichmakesuse
7、ofcorrelationfunctionstocomparesimilaritiesbetweenhistoryprofilesandpre-sentones,wepresentouralgorithmnamedrecursivecorrelationstocompletethecomparisontaskandcalculatesimilaritiesfordetectinganomalousbehaviors.Inordertoverifythevalidityofourapproach,wesimulatesomekindsofanomal
8、ousbehaviorsbasedontelnetsessionsandcomparetheminedprofileswi
