面向内部威胁检测的用户跨域行为模式挖掘

发布时间：2018-04-22 17:37

本文选题：内部威胁 + 多检测域　；参考：《计算机学报》2016年08期

【摘要】：内部用户行为分析是系统安全领域中一个重要的研究问题.近期的工作主要集中在用户单域行为的单一模式分析技术,同时依赖于领域知识和用户背景,不适用于多检测域场景.文中提出一种新的用户跨域行为模式分析方法.该方法能够分析用户行为的多元模式.此外,该方法是完全数据驱动的方法,不需要依赖相关领域知识和用户背景属性.最后作者基于文中的用户行为模式分析方法设计了一种面向内部攻击的检测方法.在实验中,作者使用文中方法分析了真实场景中的5种用户审计日志,实验结果验证了文中分析方法在多检测域场景中分析用户行为多元模式的有效性,同时文中检测方法优于两种已有方法:单域检测方法和基于单一行为模式的检测方法.
[Abstract]:Internal user behavior analysis is an important research problem in the field of system security. The recent work mainly focuses on the single pattern analysis technology of user's single domain behavior, which depends on domain knowledge and user background, and is not suitable for multi-detection domain scenarios. In this paper, a new cross-domain behavior pattern analysis method for users is proposed. This method can analyze multiple patterns of user behavior. In addition, the method is completely data-driven and does not depend on domain knowledge and user background attributes. Finally, the author designs a detection method for internal attack based on the user behavior pattern analysis method in this paper. In the experiment, the author analyzes five kinds of user audit logs in the real scene by using the method in this paper. The experimental results verify the effectiveness of the analysis method in the multi-detection domain scenario to analyze the multiple patterns of user behavior. At the same time, the detection method is superior to two existing methods: single domain detection method and single behavior mode based detection method.
【作者单位】：中国科学院信息工程研究所;
【基金】：国家“八六三”高技术研究发展计划项目基金(2013AA013204)资助
【分类号】：TP309

【相似文献】