用于开放企业环境下行为检测的证据信任模型

Evidence Trust Model for Behaviors Detection Under Open Enterprise Environment

针对开放环境下应用系统中异常行为难以检测和检测率低的问题,提出基于信任的行为多点检测模型以提高对异常行为的区分度,降低行为检测误检率,弥补传统行为检测的不足.模型解决不同检测模型的融合问题,并针对不同的行为规则集给出一种基于行为匹配和行为反馈的通用行为量化方法;运用D-S证据理论构建证据信任模型,并基于基本概率分配函数构建信任三元组,再通过三元组归一化计算综合信任,继而依据可信评估函数综合判定异常行为的可信程度;通过MIT林肯实验室1999 DARPA BSM数据集的一组实验说明该模型的有效性,在提高检测率的同时降低了误检率.

To deal with the problem of the suspicious behavior detection difficulty and detection rate low in open environment enter- prise application system, a trust-based multi-point behavior detection model was proposed to improve the discrimination of abnormal behavior, reduce the false position rate of behavior detection, and compensate for the shortcoming of traditional behavior detection. First, the model solve the integration problems in different detection model, a based on behavior match and behavior feedback common behavior quantitative methods for different behavior rules set; Then build the evidence trust model by D-S evidence theory （ DSTM ）, form the trust triples based on the basic probability assignment function, calculate the composite trust by normalization method, the credibility of abnormal behavior was determined by credible evaluation function;Finally a set of experiments based on MIT Lincoln Laboratory 1999 DARPA BSM dataset showed that DSTM improve the detection rate while reducing the false position rate effectively.