基于shell命令和Markov链模型的用户行为异常检测

田新广; 孙春来; 段洣毅

doi:10.3724/SP.J.1146.2006.00403

基于shell命令和Markov链模型的用户行为异常检测

doi: 10.3724/SP.J.1146.2006.00403

田新广^{①②;孙春来},
孙春来,
段洣毅

基金项目:

国家863高技术研究发展基金(863-307-7-5)和北京首信集团科研基金(050203)资助课题

计量
- 文章访问数: 3405
- HTML全文浏览量: 115
- PDF下载量: 1003
- 被引次数: 0
出版历程
- 收稿日期: 2006-04-03
- 修回日期: 2006-09-26
- 刊出日期: 2007-11-19

Anomaly Detection of User Behaviors Based on Shell Commands and Markov Chain Models

Tian Xin-guang^{①②;孙春来},
Sun Chun-lai,
Duan mi-yi

摘要

摘要: 异常检测是目前入侵检测系统(IDS)研究的主要方向。该文提出一种基于shell命令和Markov链模型的用户行为异常检测方法，该方法利用一阶齐次Markov链对网络系统中合法用户的正常行为进行建模，将Markov链的状态与用户执行的shell命令联系在一起，并引入一个附加状态；Markov链参数的计算中采用了运算量较小的命令匹配方法；在检测阶段，基于状态序列的出现概率对被监测用户当前行为的异常程度进行分析，并提供了两种可选的判决方案。文中提出的方法已在实际入侵检测系统中得到应用，并表现出良好的检测性能。
- 入侵检测;shell命令;Markov链;异常检测;行为轮廓
Abstract: Anomaly detection acts as one of the important directions of research on Intrusion Detection Systems(IDSs).This paper presents a new method for anomaly detection of user behaviors based on shell commands and Markov chain models. The method constructs a one-order Markov chain model to represent the normal behavior profile of a network user, and associates shell commands with the states of the Markov chain. The parameters of the Markov chain model are estimated by a command matching algorithm which is computationally efficient. At the detection stage, the probabilities of the state sequences of the Markov chain is firstly computed, and two different schemes can be used to determine whether the monitored users behaviors are normal or anomalous while the particularity of user behaviors is taken into account. The application of the method in practical intrusion detection systems shows that it can achieve high detection performance.

HTML全文

参考文献(1)

Lane T and Carla E B. An empirical study of two approaches to sequence learning for anomaly detection[J].Machine Learning.2003, 51(1):73-107[2]Ye N, Zhang Y, and Borror C M. Robustness of the Markov chain model for cyber attack detection. IEEE Trans. on Reliability, 2003, 52(3): 122-138.[3]Lane T. Machine learning techniques for the computer security domain of anomaly detection [Ph.D.Thesis]. Purdue University, 2000.[4]Mukkamala S, Sung A H, and Abraham A. Intrusion detection using an ensemble of intelligent paradigms[J].Journal of Network and Computer Application.2005, 28(2):167-182[5]连一峰，戴英侠，王航. 基于模式挖掘的用户行为异常检测. 计算机学报, 2002, 25(3): 325-330.[6]Yan Qiao, Xie Wei-Xin, and Yang Bin, et al.. An anomaly intrusion detection method based on HMM[J].Electronics Letters.2002, 38(13):663-664[7]Warrender C, Forrest S, and Pearlmutter B. Detecting intrusions using system calls: alternative data models. Proc. of The 1999 IEEE Symposium on Security and Privacy, Oakland, CA, USA, 1999: 133-145.[8]Maxion R A and Townsend T N. Masquerade detection using truncated command lines. Proc. of International Conference on Dependable Systems and Networks, Washington, DC, USA, 2002: 219-228.[9]Lane T and Brodley C E. Temporal sequence learning and data reduction for anomaly detection[J].ACM Trans. on Information and System Security.1999, 2(3):295-331[10]Schonlau M and DuMouchel W, et al.. Computer intrusion: Detecting masquerades[J].Statistical Science.2001, 16(1):58-74[11]孙宏伟，田新广，李学春，张尔扬. 一种改进的IDS异常检测模型. 计算机学报, 2003, 26(11): 1450-1455.[12]田新广. 基于主机的入侵检测方法研究. [博士论文]. 长沙: 国防科技大学, 2005.[13]田新广，高立志，张尔扬. 新的基于机器学习的入侵检测方法. 通信学报, 2006, 27(6): 108-114.

施引文献

资源附件(0)

访问统计