Anomaly detection has been an active research topic in the field of network intrusion detection for many years. A novel method is presented for anomaly detection based on system calls into the kernels of Unix or Linux...Anomaly detection has been an active research topic in the field of network intrusion detection for many years. A novel method is presented for anomaly detection based on system calls into the kernels of Unix or Linux systems. The method uses the data mining technique to model the normal behavior of a privileged program and uses a variable-length pattern matching algorithm to perform the comparison of the current behavior and historic normal behavior, which is more suitable for this problem than the fixed-length pattern matching algorithm proposed by Forrest et al. At the detection stage, the particularity of the audit data is taken into account, and two alternative schemes could be used to distinguish between normalities and intrusions. The method gives attention to both computational efficiency and detection accuracy and is especially applicable for on-line detection. The performance of the method is evaluated using the typical testing data set, and the results show that it is significantly better than the anomaly detection method based on hidden Markov models proposed by Yan et al. and the method based on fixed-length patterns proposed by Forrest and Hofmeyr. The novel method has been applied to practical hosted-based intrusion detection systems and achieved high detection performance.展开更多
移动对象的语义行为模式挖掘是当前移动对象研究中关注的热点,有益于诸多应用场景,如朋友推荐系统、轨迹破案领域和个性化服务等.目前语义行为模式挖掘方法没有考虑移动对象在停留点的停留时间,不能准确地分辨出移动对象之间的不同行为...移动对象的语义行为模式挖掘是当前移动对象研究中关注的热点,有益于诸多应用场景,如朋友推荐系统、轨迹破案领域和个性化服务等.目前语义行为模式挖掘方法没有考虑移动对象在停留点的停留时间,不能准确地分辨出移动对象之间的不同行为模式.为了解决上述问题,提出了一种基于停留时间的语义行为模式挖掘(discovering common behavior using staying duration on semantic trajectory,DSTra)方法,首先挖掘每个移动对象的频繁语义行为模式,然后定义语义行为模式之间的相似性度量方法,最后采用层次聚类的方法对移动对象进行聚类,找出具有相似行为模式的移动对象群体.实验结果表明:该方法不仅具有合理性和有效性,同时还具有较高的准确率和较好的效率.展开更多
基金supported by the National Grand Fundamental Research "973" Program of China (2004CB318109)the National High-Technology Research and Development Plan of China (2006AA01Z452)the National Information Security "242"Program of China (2005C39).
文摘Anomaly detection has been an active research topic in the field of network intrusion detection for many years. A novel method is presented for anomaly detection based on system calls into the kernels of Unix or Linux systems. The method uses the data mining technique to model the normal behavior of a privileged program and uses a variable-length pattern matching algorithm to perform the comparison of the current behavior and historic normal behavior, which is more suitable for this problem than the fixed-length pattern matching algorithm proposed by Forrest et al. At the detection stage, the particularity of the audit data is taken into account, and two alternative schemes could be used to distinguish between normalities and intrusions. The method gives attention to both computational efficiency and detection accuracy and is especially applicable for on-line detection. The performance of the method is evaluated using the typical testing data set, and the results show that it is significantly better than the anomaly detection method based on hidden Markov models proposed by Yan et al. and the method based on fixed-length patterns proposed by Forrest and Hofmeyr. The novel method has been applied to practical hosted-based intrusion detection systems and achieved high detection performance.
文摘移动对象的语义行为模式挖掘是当前移动对象研究中关注的热点,有益于诸多应用场景,如朋友推荐系统、轨迹破案领域和个性化服务等.目前语义行为模式挖掘方法没有考虑移动对象在停留点的停留时间,不能准确地分辨出移动对象之间的不同行为模式.为了解决上述问题,提出了一种基于停留时间的语义行为模式挖掘(discovering common behavior using staying duration on semantic trajectory,DSTra)方法,首先挖掘每个移动对象的频繁语义行为模式,然后定义语义行为模式之间的相似性度量方法,最后采用层次聚类的方法对移动对象进行聚类,找出具有相似行为模式的移动对象群体.实验结果表明:该方法不仅具有合理性和有效性,同时还具有较高的准确率和较好的效率.
