Anomaly detection of user behavior based on DTMC with states of variable-length sequences  

作　　者：XIAO Xi XIA Shu-tao TIAN Xin-guang ZHAI Qi-bin 

机构地区：[1]Graduate School at Shenzhen, Tsinghua University, Shenzhen 518055, China [2]State Key Laboratory of Information Security, Graduate University of Chinese Academy of Sciences, Beijing 100049, China [3]Key Laboratory of Network Science and Technology, Institute of Computing Technology, Chinese Academy of Sciences, Beijing 100190, China

出　　处：《The Journal of China Universities of Posts and Telecommunications》2011年第6期106-115,共10页中国邮电高校学报（英文版）

基　　金：supported by the National Natural Science Foundation of China (60972011);the Research Fund for the Doctoral Program of Higher Education of China (20100002110033);the Open Research Fund of National Mobile Communications Research Laboratory,Southeast University (2011D11)

摘　　要：In anomaly detection, a challenge is how to model a user＇s dynamic behavior. Many previous works represent the user behavior based on fixed-length models. To overcome their shortcoming, we propose a novel method based on discrete-time Markov chains （DTMC） with states of variable-length sequences. The method firstly generates multiple shell command streams of different lengths and combines them into the library of general sequences. Then the states are defined according to variable-length behavioral patterns of a valid user, which improves the precision and adaptability of user profiling. Subsequently the transition probability matrix is created. In order to reduce computational complexity, the classification values are determined only by the transition probabilities, then smoothed with sliding windows, and finally used to discriminate between normal and abnormal behavior. Two empirical evaluations on datasets from Purdue University and AT＆T Shannon Lab show that the proposed method can achieve higher detection accuracy and require less memory than the other traditional methods.In anomaly detection, a challenge is how to model a user＇s dynamic behavior. Many previous works represent the user behavior based on fixed-length models. To overcome their shortcoming, we propose a novel method based on discrete-time Markov chains （DTMC） with states of variable-length sequences. The method firstly generates multiple shell command streams of different lengths and combines them into the library of general sequences. Then the states are defined according to variable-length behavioral patterns of a valid user, which improves the precision and adaptability of user profiling. Subsequently the transition probability matrix is created. In order to reduce computational complexity, the classification values are determined only by the transition probabilities, then smoothed with sliding windows, and finally used to discriminate between normal and abnormal behavior. Two empirical evaluations on datasets from Purdue University and AT＆T Shannon Lab show that the proposed method can achieve higher detection accuracy and require less memory than the other traditional methods.

关 键 词：intrusion detection anomaly detection shell command discrete-time Markov chain （DTMC） 

分 类 号：TP368.1[自动化与计算机技术—计算机系统结构] TP393.08[自动化与计算机技术—计算机科学与技术]