基于异常检测的模糊行为序列挖掘算法研究

Algorithm of Mining Ambiguous Sequential Patterns in Intrusion Detection

异常检测是入侵检测的一种重要手段,异常检测的关键在于正常模式的刻画,而正常模式的质量取决于数据的质量。对于纯净(不带噪声)的数据,正常模式的准确度相对较高;对于不太纯净的数据,就有可能丢掉某些真正的用户特征,从而会增加误警率。基于此提出了一个ASM用户行为序列特征挖掘算法,该算法结合数据挖掘中的序列挖掘方法,利用模糊匹配技术来挖掘隐藏在噪声背后的用户行为序列。实验表明,采用模糊匹配技术为入侵检测提取正常序列模式是可行的、有效的。

User's behavior always reflects the identity and habit of him. Therefore, extracting user's behavior feature from the communication between user and computer is important and significant, especially in intrusion detection field. Unfortunately, user's behavior usually is distorted for the existing of some noise. Support measure of sequential patterns mining does not serve this purpose. Propose a new algorithm based on ambiguous match measure to extract real support for each user, and accordingly provide strong testimony for anomaly intrusion system.