基于模式挖掘的用户行为异常检测基于模式挖掘的用户行为异常检测.pdf

25 3 V o l . 25 N o . 3 2002 3 CH IN ESE J . CO MP UT ERS M ar. 2002 连一峰　戴英侠　王　航 ( 100039) , T elnet shell , , , , , . , , , : T P 18 Anomaly Detection of User Behaviors Based on Profile Mining - - L IA N Y i F eng DA I Y ing X ia WA N G Hang ( State Key Laboratory of Inf ormation Secur ity, The Graduate School of Chinese A cademy of Sciences, Beij ing 100039) AbstractA nom aly det ectio n act s as t he major dir ectio n of r esearch in int ru sion detection . De- tecting anom alies in sy st em/ u ser beh av io r prof iles can help u s t o discov er unkno wn at t ack s . T he cr it ical problem of A nom aly Detection lies in how t o con st ru ct t he nor mal u sage prof iles and how t o p erfo rm pro file comp ariso n. Fo rt unat ely , r esearchers of Columbia U niversit y point ed out a feasible solut io n fo r u s: dat a mining . T hey also present ed som e in sp iring result s o f ex periments . A s a kind o f appl icatio n-specif ic appro ach f or dat a-proces sing, dat a m ining h as the abilit y t o dis- cov er hidden kno w ledge fr om larg e v olumes of securit y au dit dat a. Dat a mining t echniques , in- clu ding associat ion analysis , sequ ence mining and data cl as sif icat io n, can g reat ly im prov e t he a- bilit y of mining user beh avior prof iles w hich usu al ly ref lect ident it ies and h abit s o f u sers . We u se Br o, a st and -alo ne syst em f or det ect ing net w o