高级持续性攻击(advanced persistent threat,APT)作为一种新型攻击,已成为SCADA(supervisory control and data acquisition)系统安全面临的主要威胁,而现有的入侵检测技术无法有效应对这一类攻击,因此研究有效的APT检测模型具有重要...高级持续性攻击(advanced persistent threat,APT)作为一种新型攻击,已成为SCADA(supervisory control and data acquisition)系统安全面临的主要威胁,而现有的入侵检测技术无法有效应对这一类攻击,因此研究有效的APT检测模型具有重要的意义。提出了一种新的APT攻击检测方法,该方法在正常日志行为建模阶段改进了对行为模式的表示方式,采用多种长度不同的特征子串表示行为模式,通过基于序列模式支持度来建立正常日志行为轮廓;在充分考虑日志事件时序特征的基础上,针对APT攻击行为复杂多变的特点,提出了基于矩阵相似匹配和判决阈值联合的检测模型。通过对比研究,该检测方法表现出了良好的检测性能。展开更多
Discovering the hierarchical structures of differ- ent classes of object behaviors can satisfy the requirements of various degrees of abstraction in association analysis, be- havior modeling, data preprocessing, patte...Discovering the hierarchical structures of differ- ent classes of object behaviors can satisfy the requirements of various degrees of abstraction in association analysis, be- havior modeling, data preprocessing, pattern recognition and decision making, etc. In this paper, we call this process as associative categorization, which is different from classical clustering, associative classification and associative cluster- ing. Focusing on representing the associations of behaviors and the corresponding uncertainties, we propose the method for constructing a Markov network （MN） from the results of frequent pattern mining, called item-associative Markov net- work （IAMN）, where nodes and edges represent the frequent patterns and their associations respectively. We further dis- cuss the properties of a probabilistic graphical model to guar- antee the IAMN＇s correctness theoretically. Then, we adopt the concept of chordal to reflect the closeness of nodes in the IAMN. Adopting the algorithm for constructing join trees from an MN, we give the algorithm for IAMN-based associa- tive categorization by hierarchical bottom-up aggregations of nodes. Experimental results show the effectiveness, efficiency and correctness of our methods.展开更多
文摘高级持续性攻击(advanced persistent threat,APT)作为一种新型攻击,已成为SCADA(supervisory control and data acquisition)系统安全面临的主要威胁,而现有的入侵检测技术无法有效应对这一类攻击,因此研究有效的APT检测模型具有重要的意义。提出了一种新的APT攻击检测方法,该方法在正常日志行为建模阶段改进了对行为模式的表示方式,采用多种长度不同的特征子串表示行为模式,通过基于序列模式支持度来建立正常日志行为轮廓;在充分考虑日志事件时序特征的基础上,针对APT攻击行为复杂多变的特点,提出了基于矩阵相似匹配和判决阈值联合的检测模型。通过对比研究,该检测方法表现出了良好的检测性能。
文摘Discovering the hierarchical structures of differ- ent classes of object behaviors can satisfy the requirements of various degrees of abstraction in association analysis, be- havior modeling, data preprocessing, pattern recognition and decision making, etc. In this paper, we call this process as associative categorization, which is different from classical clustering, associative classification and associative cluster- ing. Focusing on representing the associations of behaviors and the corresponding uncertainties, we propose the method for constructing a Markov network （MN） from the results of frequent pattern mining, called item-associative Markov net- work （IAMN）, where nodes and edges represent the frequent patterns and their associations respectively. We further dis- cuss the properties of a probabilistic graphical model to guar- antee the IAMN＇s correctness theoretically. Then, we adopt the concept of chordal to reflect the closeness of nodes in the IAMN. Adopting the algorithm for constructing join trees from an MN, we give the algorithm for IAMN-based associa- tive categorization by hierarchical bottom-up aggregations of nodes. Experimental results show the effectiveness, efficiency and correctness of our methods.
