• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Journal of systems and software >Constructing attribute weights from computer audit data for effective intrusion detection
【24h】

Constructing attribute weights from computer audit data for effective intrusion detection

机译：从计算机审核数据构造属性权重以进行有效的入侵检测

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Attributes construction and selection from audit data is the first and very important step for anomaly intrusion detection. In this paper, we present several cross frequency attribute weights to model user and program behaviors for anomaly intrusion detection. The frequency attribute weights include plain term frequency (TF) and various forms of term frequency-inverse document frequency (tfidf), referred to as Ltfidf, Mtfidf and LOGtfidf. Nearest Neighbor (NN) and k-NN methods with Euclidean and Cosine distance measures as well as principal component analysis (PCA) and Chi-square test method based on these frequency attribute weights are used for anomaly detection. Extensive experiments are performed based on command data from Schonlau et al. The testing results show that the LOGtfidf weight gives better detection performance compared with plain frequency and other types of weights. By using the LOGtfidf weight, the simple NN method and PCA method achieve the better masquerade detection results than the other 7 methods in the literature while the Chi-square test consistently returns the worst results. The PCA method is suitable for fast intrusion detection because of its capability of reducing data dimensionality while NN and k-NN methods are suitable for detection of a small data set because of its no need of training process. A HTTP log data set collected in a real environment and the sendmail system call data from University of New Mexico (UNM) are used as well and the results also demonstrate the effectiveness of the LOGtfidf weight for anomaly intrusion detection.
机译：从审计数据构建和选择属性是异常入侵检测的第一步，也是非常重要的一步。在本文中，我们提出了几种交叉频率属性权重，以对异常入侵检测的用户和程序行为进行建模。频率属性权重包括普通术语频率（TF）和各种形式的术语频率-反文档频率（tfidf），称为Ltfidf，Mtfidf和LOGtfidf。基于欧氏距离和余弦距离测度的最近邻（NN）和k-NN方法以及基于这些频率属性权重的主成分分析（PCA）和卡方检验方法用于异常检测。基于Schonlau等人的命令数据进行了广泛的实验。测试结果表明，与普通频率和其他类型的权重相比，LOGtfidf权重具有更好的检测性能。通过使用LOGtfidf权重，简单的NN方法和PCA方法比文献中的其他7种方法获得更好的假面检测结果，而卡方检验始终返回最差的结果。由于PCA方法具有降低数据维数的能力，因此它适合于快速入侵检测，而NN和k-NN方法则由于不需要训练过程而适用于小数据集的检测。还使用了在真实环境中收集的HTTP日志数据集和来自新墨西哥大学（UNM）的sendmail系统调用数据，结果还证明了LOGtfidf权重对于异常入侵检测的有效性。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号