基于Markov模型的异常用户检测  

Abnormal User Detection Based on Markov Models

作　　者：韩忠明[1] 张晨[1] 李斌[1] 

机构地区：[1]北京工商大学计算机与信息工程学院,北京100048

出　　处：《计算机仿真》2014年第6期316-320,共5页Computer Simulation

基　　金：国家自然科学基金(61170112);北京市属高等学校科学技术与研究生教育创新工程建设项目(PXM2012_014213_000037)

摘　　要：在入侵检测的研究中,异常检测已逐步成为了入侵检测研究的主要方向。为提高检测效率,提出一种基于Markov模型的行为模式-聚类(BMC)的用户行为异常检测方法,采用一阶Markov模型对多用户计算机系统中用户的正常行为进行建模,学习Markov模型参数时采用命令匹配方法。在检测阶段,通过计算状态序列出现的概率得到概率序列,并对其进行加窗和处理得到判决值序列。BMC采用KNN方法对判决值序列进行聚类,以聚类结果来对用户行为进行异常检测与分析,发现系统中潜在的入侵用户及入侵用户群组。实验结果表明BMC不仅能够判别单用户的异常入侵行为,更能够有效识别多用户计算机系统中的异常用户行为。Abnormal detection is the main direction of intrusion detection research field. A novel behavior model based on Markov - clustering （ BMC for short） was proposed in this paper. The BMC can be used to effectively detect masquerade user behavior. The BMC method utilized homogeneous first order Markov chains to model normal behavior pattern of the user in multi - user computer systems. During the process of learning parameters of Markov model, the BMC adopted the command matching method, in which the states of Markov model was constructed by the fre- quencies of the shell commands. In the test process, the BMC obtained the probability sequence by calculating the probability of state sequences, and the decision measure was computed by smoothing windows of state time sequences. Finally, the BMC took a KNN clustering method to cluster decision measure time series for abnormal user detection, and the clustering result was used to analyze the abnormal users. The experimental result shows that the BMC can effectively detect abnormal users by single user Markov model. Furthermore, the BMC can effectively detect abnormal users in multi - user computer system.

关 键 词：入侵检测 马尔科夫模型 聚类 命令 

分 类 号：TP391.9[自动化与计算机技术—计算机应用技术]