期刊文献+
任意字段
题名或关键词
题名
关键词
文摘
作者
第一作者
机构
刊名
分类号
参考文献
作者简介
基金资助
栏目信息

短序列频度模式分类异常检测 被引量：1

Frequency Pattern Classification of Short Sequences for Anomaly Detection
下载PDF
导出
摘要 正确识别短序列的局部行为性质,是提高系统调用跟踪异常检测精度的关键要素.通过分析特权程序和不同短序列的行为模式空间,认为实际采集的系统调用跟踪不仅包含了具有显著局部行为特征的正常和异常短序列,也包含了大量局部行为归属不明确的短序列.以短序列模式在系统调用跟踪中出现频度为基础,提出了未知短序列概念.根据短序列分别在正常和攻击时段具有聚类效应原理,专门设计了短序列关联算法.采用RIPPER学习算法归纳出简洁的频度模式分类规则集.实验结果表明,创建的频度模式分类异常检测方法明显地提高了对未知和已知攻击的检测能力.
作者 彭新光 靳燕
机构地区 太原理工大学计算机科学与技术系
出处 《计算机研究与发展》 EI CSCD 北大核心 2007年第z2期286-290,共5页 Journal of Computer Research and Development
基金 山西省自然科学基金项目(20041047) 太原理工大学博士基金项目(12903376)
关键词 系统安全 异常检测 系统调用 模式分类
分类号 TP393.08 [自动化与计算机技术—计算机应用技术]
  • 相关文献

参考文献13

  • 1[1]Stephanie Forrest,Steven A Hofmeyr,Anil Somayaji.A sense of self for Unix processes.In:Proc of the IEEE Symp on Security and Privacy.Los Alamitos,CA:IEEE Computer Society Press,1996.120-128
  • 2[2]C Warrender,S Forrest,B Pearlmutter.Detecting intrusions using system calls:Alternative data models.In:Proc of the IEEE Symp on Security and Privacy.Los Alamitos,CA:IEEE Computer Society Press,1999.133-145
  • 3[3]W Lee,S Stolfo,K W Mok.Data mining framework for building intrusion detection model.In:Proc of the IEEE Symp on Security and Privacy.Los Alamitos,CA:IEEE Computer Society Press,2001.120-132
  • 4[4]Hyuk-Jang Park,Sung-Bae Cho.Efficient anomaly detection by modeling privilege flows using hidden Markov model.Computer and Security,2003,22(1):45-55
  • 5[5]Mike Fugate,James R Gattiker.Computer intrusion detection with classification and anomaly detection using SVMs.Intenatinal Journal of Pattern Recognition and Artificial Intelligence,2003,17(3):441-458
  • 6[6]Xiaoshu Hang,Honghua Dai.Applying both positive and negative selection to supervised learning for anomaly detection.In:Proc of the Genetic and Evolutionary Computation Conf.New York:ACM Press,2005.345-352
  • 7[7]Peng Xinguang,Ren Kaifeng.Anomaly detection with high deviations for system security.In:Proc of IEEE Pacific Rim Symp on Dependable Computing.Los Alamitos,CA:IEEE Computer Society Press,2005.200-207
  • 8杨武,云晓春,李建华.一种基于强化规则学习的高效入侵检测方法[J].计算机研究与发展,2006,43(7):1252-1259. 被引量：12
  • 9[9]S Mukkamala,A H Sung,B M Ribeiro.Model selection for kernel based intrusion detection systems.In:Proc of Adaptive and Natural Computing Algorithms.Berlin:Springer-Verlag,2005.458-461
  • 10[10]Peng Xinguang,Zhang Junfeng.Program detection with context dependency for collaborative services.In:Proc of the IEEE Int'l Conf on Computer Supported Cooperative Work in Design.Piscataway,NJ:IEEE Press,2006.48-53

二级参考文献15

  • 1K. Illgun, R. Kemmerer, P. A. Porras. State transition analysis: A rule-based intrusion deteetion approaeh [J]. IEEE Trans. Software Engineering, 1995, 21(3): 181-199
  • 2K. Sequeira, M. Zaki. ADMIT: Anomaly-based data mining for intrusions[C]. In: Proc. 8th ACM SIGKDD Int'l Conf.Knowledge Discovery and Data Mining. New York: ACM Press,2002. 386-395
  • 3J. P. Anderson, et al. Detecting unusual program behavior using the statistical components of NIDES [OL]. http://www.sdl. sri.com/papers/5sri/5sri, pdf, 1995
  • 4H. Debar, M. Becker, D. Siboni. A neural network component for an intrusion detection system [C]. In: Proc. 1992 IEEE Symposium on Security and Privacy. Los Alamitos: IEEE Computer society Press, 1992. 240-251
  • 5C. Taylor, J. A. Foss. NATE: Network analysis of anomalous traffic events: A low-cost approach [C]. In: Proc. New Security Paradigms Workshop. New York: ACM Press, 2002. 89-96
  • 6S. J. Stolfo, A. L. Prodromidis, S. Tselepis, et al. JAM.' Java agent for meta-learning over distributed databases [C]. In: Proc.KDD-97 and AAAI'97 Workshop on AI Methods in Fraud and Risk Management. Menlo Park, CA: AAAI Press, 1997. 74-81
  • 7W. W. Cohen. Efficient rule induction [C]. In: Proc. 12th Int'l Conf. Machine Learning. San Francisco: Morgan Kaufmann,1995. 115-123
  • 8L. Wenke, S. J. Stolfo, K. W. Mok. A data mining framework for building intrusion detection models[C]. In: Proc. 1999 IEEE Symposium on Security and Privacy. Piscataway, N J: IEEE Press, 1999. 120-132
  • 9R. E. Schapire. The strength of weak learnability [J]. Machine Learning, 1990, 5(2): 197-227
  • 10W. W. Cohen, S. Yoram. A simple, fast, and effective rule learner [C]. In: Proc. 16th National Conf. Artificial Intelligence. Menlo Park, CA: AAAI Press, 1999. 335-342

共引文献11

同被引文献3

引证文献1

二级引证文献11

计算机研究与发展
2007年 第z2期

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部