基于协议语义序列的应用层交互行为异常检测  

Application layer interactive behavior anomaly detection based on protocol semantics sequences

作　　者：石旺[1] 杨英杰[1] 唐慧林[1] 董丽鹏 

机构地区：[1]解放军信息工程大学,郑州450001

出　　处：《计算机应用研究》2015年第10期3060-3064,共5页Application Research of Computers

基　　金：国家"973"计划资助项目(2011CB311801);河南省科技创新人才计划资助项目(114200510001)

摘　　要：为了有效检测出应用层异常交互行为,提出了一种基于协议语义序列的检测方法。首先利用协议语义序列对应用层交互行为进行描述,并对存在的异常交互情形进行分析;然后提出基于协议语义序列的异常检测方法,利用报文的方向和时序关系构建出标准语义序列集,并获取正常行为特征,根据异常交互情形定义检测规则,利用序列比对和决策树算法实现了对应用层交互行为的异常检测。实验结果表明,该方法具有较高的检测率和较低的误报率。In order to effectively detect application layer abnormal interactive behavior,this paper proposed a detection method based on protocol semantics sequences. First,it described the application layer interactive behavior with protocol semantics sequences and analyzed the existent abnormal interactive situations. Then,it proposed a method for anomaly detection based on protocol semantics sequences. According to the direction and order of packets,it built a set of standard protocol semantics sequences and obtained characteristics of normal behavior. After defining detection rules with abnormal interactive situations,it implemented application layer interactive behavior anomaly detection with sequence comparison and decision tree algorithm.The experimental results show that the method has a higher detection rate and lower error rate.

关 键 词：应用层交互行为 协议语义序列 检测规则 序列比对 异常检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]