中国科学院机构知识库网格
Chinese Academy of Sciences Institutional Repositories Grid
首页 机构 成果 学者
  
  1. CAS IR Grid
  2. 计算技术研究所
  3. 中国科学院计算技术研究所
  4. 中国科学院计算技术研究所期刊论文
  5. 英文
Anomaly detection of user behavior based on shell commands and homogeneous Markov chains

文献类型：期刊论文

作者Xinguang, Tian1,2; Miyi, Duan1,2; Wenfa, Li1; Chunlai, Sun2
刊名CHINESE JOURNAL OF ELECTRONICS
出版日期2008-04-01
卷号17期号:2页码:231-236
关键词intrusion detection anomaly detection shell command Markov chain
ISSN号1022-4653
英文摘要Behavior-based intrusion detection is currently an active research topic in the field of network security. This paper proposes a novel method for anomaly detection of user behavior, which is applicable to host-based intrusion detection systems using shell commands as audit data. The method employs a one-order homogeneous Markov chain model to characterize the normal behavior profile of a network user, and associates the states of the Markov chain with specific shell commands in the training data. The parameters of the Markov chain are estimated by a command matching algorithm which is computationally efficient. At the detection stage, the occurrence probabilities of the state sequences are firstly computed, and then two alternative schemes could be used to distinguish between normal and anomalous behavior. The method gives attention to both computational efficiency and detection accuracy, and is especially suitable for online detection. Our study empirically demonstrated the promising performance of the method.
WOS研究方向Engineering
语种英语
WOS记录号WOS:000255103200009
出版者TECHNOLOGY EXCHANGE LIMITED HONG KONG
源URL[http://119.78.100.204/handle/2XEOYT63/11163]  
专题中国科学院计算技术研究所期刊论文_英文
通讯作者Xinguang, Tian
作者单位1.Chinese Acad Sci, Inst Comp Technol, Beijing 100080, Peoples R China
2.Beijing Jiaotong Univ, Inst Comp Technol, Beijing 100044, Peoples R China
推荐引用方式
GB/T 7714		 Xinguang, Tian,Miyi, Duan,Wenfa, Li,et al. Anomaly detection of user behavior based on shell commands and homogeneous Markov chains[J]. CHINESE JOURNAL OF ELECTRONICS,2008,17(2):231-236.
APA Xinguang, Tian,Miyi, Duan,Wenfa, Li,&Chunlai, Sun.(2008).Anomaly detection of user behavior based on shell commands and homogeneous Markov chains.CHINESE JOURNAL OF ELECTRONICS,17(2),231-236.
MLA Xinguang, Tian,et al."Anomaly detection of user behavior based on shell commands and homogeneous Markov chains".CHINESE JOURNAL OF ELECTRONICS 17.2(2008):231-236.

入库方式： OAI收割

来源：计算技术研究所

浏览0
下载0
收藏0
其他版本

除非特别说明，本系统中所有内容都受版权保护，并保留所有权利。