摘要
针对LaneT等人提出的用户行为异常检测模型的不足,提出了一种新的IDS异常检测模型。该模型改进了用户行为模式和行为轮廓的表示方式,采用了新的相似度赋值方法,在对相似度流进行平滑时引入了“可变窗长度”的概念,并联合采用多个判决门限对用户行为进行判决。基于Unix用户shell命令数据的实验表明,该文提出的检测模型具有更高的检测性能。
An anomaly detection model originated by Lane T is briefly introduced.Then a new anomaly detection model based on machine learning is presented,The model uses shell command sequences of variable length to represent a valid user＇s behavior patterns and uses more than one dictionaries of shell command sequences to build the user＇s behavior profile.While performing detection,the model digs behavior patterns by sequence matching method and evaluates the similarities of the corresponding command sequences to the dictionaries.The two models are tested with Unix users＇ shell command data.The results show that the new model originated by us has higher detection performance.
出处
《计算机工程与应用》
CSCD
北大核心
2006年第19期101-103,111,共4页
Computer Engineering and Applications
关键词
入侵检测
异常检测
行为模式
机器学习
相似度
intrusion detection, anomaly detection, behavior pattern, machine learning, similarity measure
