摘要
传统入侵检测技术难以在发现异常入侵的同时,兼顾精准定位核心证据及线索的司法需求.MajorClust算法可以规避传统聚类算法需要事先给定聚类数量的缺陷,其侧重于对图形自身属性进行考量的特性为行为检测提供了崭新的思路.但在应用于行为证据发现时,经单次MajorClust算法处理得到的异常行为规律不够明显,也无法准确定位关键异常点.改进后的MajorClust算法在关联度计算基础上,经过多次迭代抽象处理更精准地梳理记录间关系,并通过在频率最高、到达率最高以及邻边权重之和最大这三种类型节点中合理选择簇核心点实现海量记录中核心异常行为的定位.没有沿袭传统的以单一异常参数进行异常检测的思路,而是基于行为间的关联特性连带次高异常参数予以综合判断,不同簇的核心节点信息相互印证,提升了检测结果的可信度.
Traditional intrusion detection technology is difficult to find the abnormal intrusion while taking into account the judicial needs of accurately positioning core evidence and clues. MajorClust can circumvent the traditional clustering algorithm needs to give the number of clusters in advance,and its focus on the characteristics of the graph itself provides a new idea for behavior detection. However,when applied to the discovery of behavioral evidence,the abstract behavior of the abstracted MajorClust treatment is not obvious enough,and it is impossible to accurately locate the critical anomaly. Based on the correlation degree calculation,the improved MajorClust algorithm sorts the relationship between records more accurately after repeated iteration abstraction processing,and the core anomaly behavior in mass records is achieved by reasonably selecting cluster core points in the three types of nodes with the highest frequency,the highest arrival rate and the largest sum of adjacent edges. The traditional idea of abnormality detection with a single abnormal parameter is not followed,but based on the correlation characteristics between behaviors and the second highest anomaly parameters,the core node information of different clusters is mutually verified,which improves the credibility of the detection results.
作者
罗文华
张艳
LUO Wen-hua;ZHANG Yan(Criminal Investigation Police University of China,Cyber Crime Investigation Department,Shenyang 110035,China)
出处
《小型微型计算机系统》
CSCD
北大核心
2019年第11期2374-2379,共6页
Journal of Chinese Computer Systems
基金
公安部技术研究计划重点项目(2017JSYJA10)资助
公安部理论及软科学计划项目(2018LLYJXJXY016)资助
辽宁省社科基金项目(L18BFX009)资助
中国刑事警察学院研究生创新能力提升项目(2018YCZD04)资助