论文部分内容阅读
基于主机的入侵检测是目前网络安全领域研究的热点内容。提出了一种基于数据挖掘和变长序列匹配的用户伪装入侵检测方法,主要用于Unix或Linux平台上以shell命令为审计数据的主机型入侵检测系统。该方法针对用户行为复杂多变的特点以及审计数据的短时相关性,利用多种长度不同的shell命令短序列来描述用户行为模式,并基于数据挖掘技术中的序列支持度在用户界面层对网络合法用户的正常行为进行建模;在检测阶段,采用了基于变长序列匹配和判决值加权的检测方案,通过单调递增相似度函数赋值和加窗平滑滤噪对被监测用户当前行为的异常程度进行精确分析,能够有效降低误报率,增强了检测性能的稳定性。实验表明,同目前典型的伪装入侵检测方法相比,该方法在检测准确度和计算成本方面均具有较大优势,特别适用于在线检测。
Host-based intrusion detection is a hot topic in the field of network security. This paper proposes a user camouflage intrusion detection method based on data mining and variable-length sequence matching. It is mainly used in host-based intrusion detection system with shell command as audit data on Unix or Linux platform. According to the complex and changeable behavior of users and the short-term correlation of audit data, this method uses a variety of short shell sequences to describe user behavior patterns. Based on the sequence support in data mining technology, In the detection phase, a detection scheme based on variable length sequence matching and decision value weighting is adopted. Through the monotonically increasing similarity function assignment and windowing smoothing noise, the current behavior of the monitored user is abnormal Accurate analysis of the degree can effectively reduce the false alarm rate and enhance the stability of the detection performance. Experiments show that compared with the typical camouflage intrusion detection method, this method has greater advantages in detection accuracy and computational cost, and is especially suitable for online detection.