Anomaly detection of user behavior based on DTMC with states of variable-length sequences

doi:10.1016/S1005-8885(10)60128-8

中国邮电高校学报(英文) ›› 2011, Vol. 18 ›› Issue (6): 106-115.doi: 10.1016/S1005-8885(10)60128-8

Anomaly detection of user behavior based on DTMC with states of variable-length sequences

肖喜¹,XIA Shu-tao,田新广³,翟起滨²,

1. Graduate School at Shenzhen, Tsinghua University, Shenzhen 518055, China　 2. State Key Laboratory of Information Security, Graduate University of Chinese Academy of Sciences, Beijing 100049, China　 3. Key Laboratory of Network Science and Technology, Institute of Computing Technology, Chinese Academy of Sciences, Beijing 100190, China

收稿日期:2011-03-16 修回日期:2011-07-22 出版日期:2011-12-31 发布日期:2011-12-30
通讯作者: 肖喜 E-mail:xiaoxi_ac@163.com
基金资助:
This work was supported by the National Natural Science Foundation of China (60972011), the Research Fund for the Doctoral Program of Higher Education of China (20100002110033), and the Open Research Fund of National Mobile Communications Research Laboratory，Southeast University (2011D11).

Anomaly detection of user behavior based on DTMC with states of variable-length sequences

1. Graduate School at Shenzhen, Tsinghua University, Shenzhen 518055, China　 2. State Key Laboratory of Information Security, Graduate University of Chinese Academy of Sciences, Beijing 100049, China　 3. Key Laboratory of Network Science and Technology, Institute of Computing Technology, Chinese Academy of Sciences, Beijing 100190, China

Received:2011-03-16 Revised:2011-07-22 Online:2011-12-31 Published:2011-12-30
Supported by:
This work was supported by the National Natural Science Foundation of China (60972011), the Research Fund for the Doctoral Program of Higher Education of China (20100002110033), and the Open Research Fund of National Mobile Communications Research Laboratory，Southeast University (2011D11).

摘要/Abstract

摘要：

In anomaly detection, a challenge is how to model a user’s dynamic behavior. Many previous works represent the user behavior based on fixed-length models. To overcome their shortcoming, we propose a novel method based on discrete-time Markov chains (DTMC) with states of variable-length sequences. The method firstly generates multiple shell command streams of different lengths and combines them into the library of general sequences. Then the states are defined according to variable-length behavioral patterns of a valid user, which improves the precision and adaptability of user profiling. Subsequently the transition probability matrix is created. In order to reduce computational complexity, the classification values are determined only by the transition probabilities, then smoothed with sliding windows, and finally used to discriminate between normal and abnormal behavior. Two empirical evaluations on datasets from Purdue University and AT&T Shannon Lab show that the proposed method can achieve higher detection accuracy and require less memory than the other traditional methods.

关键词:

intrusion detection, anomaly detection, shell command, discrete-time Markov chain (DTMC)

Abstract:

Key words:

intrusion detection, anomaly detection, shell command, discrete-time Markov chain (DTMC)

中图分类号:

TP393

参考文献

1. Wang W, Guan X, Zhang X. Processing of massive audit data streams for real-time anomaly intrusion detection. Computer Communications, 2008, 31(1): 58-72

2. Tian X G, Duan M Y, Cheng X Q. Masquerade detection based on shell commands and multiple behavior pattern mining. Chinese Journal of Computers, 2010, 33(4): 697-705 (in Chinese)

3. Dash S K, Reddy K S, Pujari A K. Adaptive Naive Bayes method for masquerade detection. Security and Communication Networks, 2011, 4(4): 410-417

4. Oka M, Oyama Y, Abe H, et al. Anomaly detection using layered networks based on eigen co-occurrence matrix. Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection (RAID’04), Sep 15-17, 2004, French Riviera, France. LNCS 3224. Berlin, Germany: Springer- Verlag, 2004: 223-237

5. Lane T. Machine learning techniques for the computer security domain of anomaly detection.Doctoral Dissertation. West Lafayette, IN, USA: Purdue University, 2000

6. Lane T, Brodley C E. An empirical study of two approaches to sequence learning for anomaly detection. Machine Learning, 2003, 51(1): 73-107

7. Szymanski B K, Zhang Y Q. Recursive data mining for masquerade detection and author identification. Proceedings of the 5th IEEE System, Man and Cybernetics Information Assurance Workshop (SMC’05), Jun 10-11, 2005, West Point, NY, USA. Los Alamitos, CA, USA: IEEE Computer Society, 2004: 424-431

8. Tian X G, Duan M Y, Li W F, et al. Anomaly detection of user behavior based on shell commands and homogeneous Markov chains. Chinese Journal of Electronics, 2008, 17(2): 231-236

9. Schonlau M, DuMouchel W, Ju W H, et al. Computer intrusion: detecting masquerades. Statistical Science, 2001, 16(1): 58-74

10. Sun H W, Tian X G, Li X C, et al. An improved anomaly detection model for IDS. Chinese Journal of Computers, 2003, 26(11): 1450-1455 (in Chinese)

11. Tian X G, Gao L Z, Sun C L, et al. A method for anomaly detection of user behaviors based on machine learning. The Journal of China Universities of Posts and Telecommunications, 2006, 13(2): 61-65, 78

12. Maxion R A, Townsend T N. Masquerade detection using truncated command lines. Proceedings of the IEEE/IFIP International Conference on Dependable Systems and Networks (DSN’02), Jun 23-26, 2002, Washington, DC, USA. Piscataway, NJ, USA: IEEE, 2002: 219-228

13. Wang K, Stolfo S J. One class training for masquerade detection. Proceedings of the3rd IEEE Conference Data Mining Workshop on Data Mining for Computer Security (DMSEC’ 03),Nov 19-22, Melbourne, FL,USA. Piscataway, NJ, USA: IEEE, 2003: 10p

14. Wang W, Guan X, Zhang X. Profiling program and user behaviors for anomaly intrusion detection based on non-negative matrix factorization. Proceedings of the 43rd IEEE Conference on Decision and Control (CDC’04), Dec 14-17, 2004, Atlantis, Paradise Island, Bahamas. Los Alamitos: IEEE Computer Society, 2004: 99-104

15. Wan M D, Wu H C, Kuo Y W, et al. Detecting masqueraders using high frequency commands as signatures. Proceedings of the 22nd International Conference on Advanced Information Networking and Applications- Workshops (AINAW’08), Mar 25-28, 2008, Okinawa, Japan. Piscataway, NJ, USA: IEEE, 2008: 596-601

16. Dash S, Reddy K, Pujari A. Episode based masquerade detection. Proceedings of the 1st International Conference on Information Systems Security (ICISS’05), Dec 19-21, 2005,Calcutta, India. LNCS 3803. Berlin, Germany: Springer-Verlag, 2005: 251-262

17. Coull S E, Branch J W, Szymanski B K, et al. Sequence alignment for masquerade detection. Computational Statistics and Data Analysis, 2008, 52(8): 4116-4131

18. Karlin S, Taylor H M. A first course in stochastic processes. 2nd ed.New York, NY, USA: Academic Press, 1975

[1]	肖雅郑世慧孙斌. Trusted GPSR protocol without reputation faking in VANET[J]. Acta Metallurgica Sinica(English letters), 2015, 22(5): 22-31.
[2]	石文孝吴丹许银龙王继红. Routing metric of interference-aware link quality: an improved ETX in wireless mesh networks[J]. Acta Metallurgica Sinica(English letters), 2014, 21(5): 61-67.
[3]	肖丁石川. Autonomic discovery of subgoals in hierarchical reinforcement learning[J]. Acta Metallurgica Sinica(English letters), 2014, 21(5): 94-104.
[4]	童俊杰鄂海红宋美娜宋俊德. Host load prediction in cloud based on classification methods[J]. Acta Metallurgica Sinica(English letters), 2014, 21(4): 40-46.
[5]	徐嬴颖陈常嘉赵永祥陈一帅. Cloud download system optimizing by job and notification scheduling[J]. Acta Metallurgica Sinica(English letters), 2014, 21(4): 47-53.
[6]	王若愚刘珍张凌. Method of data cleaning for network traffic classification[J]. Acta Metallurgica Sinica(English letters), 2014, 21(3): 35-45.
[7]	林文辉雷振明刘军杨洁刘芳何刚,WANG Qin. MapReduce optimization algorithm based on machine learning in heterogeneous cloud environment[J]. Acta Metallurgica Sinica(English letters), 2013, 20(6): 77-87.
[8]	李文霁郑康锋张冬梅 YE-Qing YANG Yi-xian. Efficient identity-based signature scheme with batch authentication for delay tolerant mobile sensor network [J]. Acta Metallurgica Sinica(English letters), 2013, 20(4): 80-86.
[9]	付雄 ZHU Xin-xin, HAN Jing-yu, WANG Ru-chuan. QoS-aware replica placement for data intensive applications[J]. Acta Metallurgica Sinica(English letters), 2013, 20(3): 43-47.
[10]	姚玉坤王冠任智李鹏翔陈永超. Efficient distributed address assignment algorithm based on topology maintenance in ZigBee networks[J]. Acta Metallurgica Sinica(English letters), 2013, 20(3): 53-59.
[11]	张招亮李栋黄庭培崔莉. Leveraging data fusion to improve barrier coverage in wireless sensor networks[J]. Acta Metallurgica Sinica(English letters), 2013, 20(1): 26-36.
[12]	沙超王汝传. Energy-efficient node deployment strategy forwireless sensor networks[J]. Acta Metallurgica Sinica(English letters), 2013, 20(1): 54-57.
[13]	姚玉坤温亚迪任智刘智虎. High efficient multipacket decoding approach for network coding in wireless networks[J]. Acta Metallurgica Sinica(English letters), 2013, 20(1): 95-100.
[14]	詹振球朱杰孙宜进. Further results on local stability of LRC-RED algorithm in Internet[J]. Acta Metallurgica Sinica(English letters), 2012, 19(5): 99-103.
[15]	詹振球朱杰徐迪. Stability analysis in an AVQ model of Internet congestion control algorithm[J]. Acta Metallurgica Sinica(English letters), 2012, 19(4): 22-28.

Anomaly detection of user behavior based on DTMC with states of variable-length sequences

Anomaly detection of user behavior based on DTMC with states of variable-length sequences

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

本文评价