在网络安全事件流中异常检测的方法  

Method for anomaly detection in network security event stream

作　　者：李润恒[1] 贾焰[1] 

机构地区：[1]国防科技大学计算机学院,湖南长沙410073

出　　处：《通信学报》2009年第12期27-35,44,共10页Journal on Communications

基　　金：国家高技术研究发展计划("863"计划)基金资助项目(2007AA01Z474;2006AA01Z451)~~

摘　　要：针对网络安全事件流中异常检测问题,定义网络安全异常事件模式为候选频繁情节,基于无折叠出现的频繁度定义研究网络安全事件流中频繁情节发现方法。该方法中,针对事件流的特点,提出了频繁度密度概念;针对网络安全异常事件模式的时间间隔限制,利用事件流中滑动窗口设计算法;针对复合攻击模式的特点,对算法进行剪枝。实验证明本文方法的时空复杂性、漏报率符合网络安全事件流中异常检测的需求。Anomalous patterns of network security events were defmed as episodes to serach episodes in network security event streams based on frequency definition of non-overlapped occurrences. First, density of frequency was defined for characteristic of event streams.Then,for time interval constrain of anomalous patterns in network security event streams, sliding window was used. Finaly, pruning algorithm was proposed for multi-step attacks. Experiment results prove that this method is efficient and has low false negative rate for anomaly detection in network security event streams.

关 键 词：信息安全 异常检测 情节 频繁度 无折叠出现 滑动窗口 剪枝 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]