中国邮电高校学报(英文) ›› 2011, Vol. 18 ›› Issue (6): 106-115.doi: 10.1016/S1005-8885(10)60128-8

• Others • 上一篇    下一篇

Anomaly detection of user behavior based on DTMC with states of variable-length sequences

肖喜1,XIA Shu-tao,田新广3,翟起滨2,   

  1. 1. Graduate School at Shenzhen, Tsinghua University, Shenzhen 518055, China  2. State Key Laboratory of Information Security, Graduate University of Chinese Academy of Sciences, Beijing 100049, China  3. Key Laboratory of Network Science and Technology, Institute of Computing Technology, Chinese Academy of Sciences, Beijing 100190, China
  • 收稿日期:2011-03-16 修回日期:2011-07-22 出版日期:2011-12-31 发布日期:2011-12-30
  • 通讯作者: 肖喜 E-mail:xiaoxi_ac@163.com
  • 基金资助:

    This work was supported by the National Natural Science Foundation of China (60972011), the Research Fund for the Doctoral Program of Higher Education of China (20100002110033), and the Open Research Fund of National Mobile Communications Research Laboratory,Southeast University (2011D11).

Anomaly detection of user behavior based on DTMC with states of variable-length sequences

  1. 1. Graduate School at Shenzhen, Tsinghua University, Shenzhen 518055, China  2. State Key Laboratory of Information Security, Graduate University of Chinese Academy of Sciences, Beijing 100049, China  3. Key Laboratory of Network Science and Technology, Institute of Computing Technology, Chinese Academy of Sciences, Beijing 100190, China
  • Received:2011-03-16 Revised:2011-07-22 Online:2011-12-31 Published:2011-12-30
  • Supported by:

    This work was supported by the National Natural Science Foundation of China (60972011), the Research Fund for the Doctoral Program of Higher Education of China (20100002110033), and the Open Research Fund of National Mobile Communications Research Laboratory,Southeast University (2011D11).

摘要:

In anomaly detection, a challenge is how to model a user’s dynamic behavior. Many previous works represent the user behavior based on fixed-length models. To overcome their shortcoming, we propose a novel method based on discrete-time Markov chains (DTMC) with states of variable-length sequences. The method firstly generates multiple shell command streams of different lengths and combines them into the library of general sequences. Then the states are defined according to variable-length behavioral patterns of a valid user, which improves the precision and adaptability of user profiling. Subsequently the transition probability matrix is created. In order to reduce computational complexity, the classification values are determined only by the transition probabilities, then smoothed with sliding windows, and finally used to discriminate between normal and abnormal behavior. Two empirical evaluations on datasets from Purdue University and AT&T Shannon Lab show that the proposed method can achieve higher detection accuracy and require less memory than the other traditional methods.

关键词:

intrusion detection, anomaly detection, shell command, discrete-time Markov chain (DTMC)

Abstract:

In anomaly detection, a challenge is how to model a user’s dynamic behavior. Many previous works represent the user behavior based on fixed-length models. To overcome their shortcoming, we propose a novel method based on discrete-time Markov chains (DTMC) with states of variable-length sequences. The method firstly generates multiple shell command streams of different lengths and combines them into the library of general sequences. Then the states are defined according to variable-length behavioral patterns of a valid user, which improves the precision and adaptability of user profiling. Subsequently the transition probability matrix is created. In order to reduce computational complexity, the classification values are determined only by the transition probabilities, then smoothed with sliding windows, and finally used to discriminate between normal and abnormal behavior. Two empirical evaluations on datasets from Purdue University and AT&T Shannon Lab show that the proposed method can achieve higher detection accuracy and require less memory than the other traditional methods.

Key words:

intrusion detection, anomaly detection, shell command, discrete-time Markov chain (DTMC)

中图分类号: