云安全审计中基于日志的用户行为分析  

Log-based analysis on users′ behavior in cloud security auditing

作　　者：赵春晔 涂山山[1] 陈昊宇[2] 黄永峰[1] 

机构地区：[1]清华大学电子系,北京100084 [2]北京邮电大学国际学院,北京100876

出　　处：《现代电子技术》2017年第2期1-5,11,共6页Modern Electronics Technique

基　　金：国家自然科学基金(U1405254;U1536115;U1536207;61271392);中国博士后基金(2015M581101)资助

摘　　要：云存储将网络中大量不同类型的存储设备集合起来协同工作,共同对外提供数据存储服务。由于其特征上存在着用户和服务商之间的信任博弈,因此构建一个健康、公平、安全的云数据服务环境,对云数据的状态及操作过程执行客观、公正的安全审计尤为重要。为此,提出一种基于用户行为日志分析的云安全审计解决方案,通过制定数据"用户行为"描述,从功能上实现基于用户行为的系统日志信息分析,同时改进现有关联规则挖掘算法,提出一种针对长序列的关联规则挖掘算法。最后通过实验表明该方案可有效地实现云安全审计中隐私数据泄露的追踪与取证。Cloud Storage provides data storage service for external by combing and coordinating different types of storage devices in the network,so that they can collectively work together. However it always exists a trust game relationship between users and service providers,therefore it is important to build a healthy,fair and secure cloud data service environment for the security auditing on the state of cloud data and operation processes. A cloud security-auditing scheme based on analysis of user behavior（UB）log data from cloud servers is proposed in this paper. The system log information analysis based on UB is realized functionally by description rules of UB. And the existing association rule mining algorithm is improved simultaneously,which is proposed for dealing with the Long Sequence Frequent Pattern（LSFP）to extract UB. The experiment result indicates that the solution can implement the tracking and evidence taking of data leakage efficiently for the cloud security auditing.

关 键 词：云安全审计 日志分析 关联规则 追踪与取证 

分 类 号：TN911-34[电子电信—通信与信息系统] TP309.2[电子电信—信息与通信工程]