This paper presents a new anomaly detection method based on machine learning. Applicable to host-based intrusion detection .systems, this method uses shell commands as audit data. The method employs shell command sequ...This paper presents a new anomaly detection method based on machine learning. Applicable to host-based intrusion detection .systems, this method uses shell commands as audit data. The method employs shell command sequences of different lengths to characterize behavioral patterns of a network user, and constructs multiple sequence libraries to represent the user＇s normal behavior profile. In the detection stage, the behavioral patterns in the audit data are mined by a sequence-matching algorithm, and the similarities between the mined patterns and the historical profile are evaluated. These similarities are then smoothed with sliding windows, and the smoothed similarities are used to determine whether the monitored user＇s behaviors are normal or anomalous. The results of our experience show the method can achieve higher detection accuracy and .shorter detection time than the instance-based method presented by Lane T. The method has been successfully applied in practical host-based intrusion detection systems.展开更多
In anomaly detection, a challenge is how to model a user＇s dynamic behavior. Many previous works represent the user behavior based on fixed-length models. To overcome their shortcoming, we propose a novel method base...In anomaly detection, a challenge is how to model a user＇s dynamic behavior. Many previous works represent the user behavior based on fixed-length models. To overcome their shortcoming, we propose a novel method based on discrete-time Markov chains （DTMC） with states of variable-length sequences. The method firstly generates multiple shell command streams of different lengths and combines them into the library of general sequences. Then the states are defined according to variable-length behavioral patterns of a valid user, which improves the precision and adaptability of user profiling. Subsequently the transition probability matrix is created. In order to reduce computational complexity, the classification values are determined only by the transition probabilities, then smoothed with sliding windows, and finally used to discriminate between normal and abnormal behavior. Two empirical evaluations on datasets from Purdue University and AT＆T Shannon Lab show that the proposed method can achieve higher detection accuracy and require less memory than the other traditional methods.展开更多
文摘This paper presents a new anomaly detection method based on machine learning. Applicable to host-based intrusion detection .systems, this method uses shell commands as audit data. The method employs shell command sequences of different lengths to characterize behavioral patterns of a network user, and constructs multiple sequence libraries to represent the user＇s normal behavior profile. In the detection stage, the behavioral patterns in the audit data are mined by a sequence-matching algorithm, and the similarities between the mined patterns and the historical profile are evaluated. These similarities are then smoothed with sliding windows, and the smoothed similarities are used to determine whether the monitored user＇s behaviors are normal or anomalous. The results of our experience show the method can achieve higher detection accuracy and .shorter detection time than the instance-based method presented by Lane T. The method has been successfully applied in practical host-based intrusion detection systems.
基金supported by the National Natural Science Foundation of China (60972011)the Research Fund for the Doctoral Program of Higher Education of China (20100002110033)the Open Research Fund of National Mobile Communications Research Laboratory,Southeast University (2011D11)
文摘In anomaly detection, a challenge is how to model a user＇s dynamic behavior. Many previous works represent the user behavior based on fixed-length models. To overcome their shortcoming, we propose a novel method based on discrete-time Markov chains （DTMC） with states of variable-length sequences. The method firstly generates multiple shell command streams of different lengths and combines them into the library of general sequences. Then the states are defined according to variable-length behavioral patterns of a valid user, which improves the precision and adaptability of user profiling. Subsequently the transition probability matrix is created. In order to reduce computational complexity, the classification values are determined only by the transition probabilities, then smoothed with sliding windows, and finally used to discriminate between normal and abnormal behavior. Two empirical evaluations on datasets from Purdue University and AT＆T Shannon Lab show that the proposed method can achieve higher detection accuracy and require less memory than the other traditional methods.
