摘要
伪装入侵是指非授权用户伪装成合法用户进入系统访问关键数据或执行非法操作的行为,现有伪装入侵检测方法大多通过获取用户敏感数据对用户特征进行建模。针对上述问题,提出一种基于网络流统计数据的伪装入侵检测方法,使用网络流统计数据作为用户特征,并结合AdaBoost与支持向量机对用户特征进行训练与预测。在一个真实网络抓包数据集上的实验结果表明,该方法能在有效抵御伪装入侵的同时不侵犯用户隐私,系统检测率为97.5%、误报率为1.1%,且系统检测延时仅为毫秒级,证明了其检测性能优于现有伪装入侵检测方法。
Masquerade intrusion is attack by unauthorized users to obtain access to confidential data or conduct other illegal operation. Currently, masquerade detection largely depends on the retrieval of user's sensitive information to model the user characteristics. To avoid the violation of user privacy, this paper proposes a new masquerade intrusion detection method based on network flow statistical data. User Characteristic modeling is illustrated in details and a hybrid algorithm combining AdaBoost and Support Vector Machine(SVM) is also introduced to train and predict user behavior. Experiments on a real packet data set show that the method can resist masquerade intrusion, preserve user privacy, and its system detection rate is 97.5%, false positive rate is 1.1% when delay is in milliseconds, prove that the detection performance of this method is better than the existing methods.
出处
《计算机工程》
CAS
CSCD
2014年第7期78-81,共4页
Computer Engineering
基金
信息网络安全公安部重点实验室开放课题基金资助项目(C12612)
关键词
伪装入侵
支持向量机
网络流
机器学习
分类器
隐私保护
masquerade intrusion
Support Vector Machine(SVM)
network flow
machine learning
classifier
privacy protection