Abnormal Network Behavior Detection Technology Based on Statistical Learning

Tao Zhou

doi:10.11959/j.issn.2096-0271.2015039

您当前的位置：

首页 >

文章列表页 >

Abnormal Network Behavior Detection Technology Based on Statistical Learning

Special topic:Big data of finance and security | 更新时间：2024-06-03

- Abnormal Network Behavior Detection Technology Based on Statistical Learning
- BIG DATA RESEARCH Vol. 1, Issue 4, Pages: 30-39(2015)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-0271.2015039
  CLC： TP311.13
- Online First：2015-11，
  
  Published：20 November 2015
- 稿件说明：
移动端阅览
Tao Zhou. Abnormal Network Behavior Detection Technology Based on Statistical Learning[J]. BIG DATA RESEARCH, 2015, 1(4): 30-39.
DOI：

Tao Zhou. Abnormal Network Behavior Detection Technology Based on Statistical Learning[J]. BIG DATA RESEARCH, 2015, 1(4): 30-39. DOI： 10.11959/j.issn.2096-0271.2015039.

摘要

高级持续性威胁（APT）已经成为企业级安全用户的首要安全威胁。传统基于特征检测、边界防护的安全防范措施在应对APT攻击时存在不足。为此，介绍了网络异常行为检测方法的现状；分析了基于统计学习的检测方法的技术路线和体系架构，并以命令控制通道、获取行为等APT攻击中的典型环节为例，介绍了相关的参数提取和统计分析建模方法；总结了基于大数据的异常行为检测的特点，并指出了后续研究方向。

Abstract

In recent years

advanced persistent threat (APT) has become the chief threat to enterprise users.The traditional security protection methods

such as signature-based detection and perimeter protection

are insufficient in dealing with APT.Therefore

the status of network anomaly behavior detection method was described.The technology roadmap and system architecture of abnormal behavior detection based on statistical learning were introduced.The feature extract method and statistical modeling methods were proposed.The characteristic of abnormal behavior detection based on big data was concluded and the direction of future research was proposed.

关键词

Keywords

references

Yen T F , Oprea A , Onarlioglu K , et al . Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks . Proceedings of the 29th Annual Computer Security Applications Conference , New Orleans, Louisiana, USA , 2013 : 199 ～ 208

Kim A S , Kong H J , Hong S C , et al . A flow-based method for abnormal network traffic detection . Network Operations and Management Symposium , 2004 ( 1 ): 599 ～ 612

McCusker O , Brunza S , Dasgupta D . Deriving behavior primitives from aggregate network features using support vector machines . Proceedings of IEEE 5th International Conference on Cyber Conflict (CyCon) , Tallinn,Estonia , 2013 : 1 ～ 18

Bhatt P , Toshiro Y E , Gustavsson P M . Towards a framework to detect multi-stage advanced persistent threats attacks . Proceedings of the 8th International Symposium on Service-Oriented System Engineering , Oxford, UK , 2014 : 390 ～ 395

Garcia-Teodoro P , Diaz-Verdejo J , Maciá-Fernández G , et al . Anomaly-based network intrusion detection:techniques, systems and challenges . Computers & Security , 2009 , 28 ( 1 ): 18 ～ 28

Hutchins E M , Cloppert M J , Amin R M . Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains . Leading Issues in Information Warfare &Security Research , 2011 ( 1 ): 80 ～ 106

Views

690

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

A scalable parallel sorting algorithm by regular sampling for big data

Gansu smart tourism system based on big data

Big data and computing models

Analysis and research on the strategy and problems of “Channel Computing Resources from the East to the West”

Digital transformation in higher education:a systematic review

Related Author

Ying WANG

Zhiguang CHEN

Yutong LU

Liang GUO

Yi YANG

Bingfeng QIN

Jianwen CAO

Min LI

Related Institution

School of Information Science and Engineering, Lanzhou University

Key Laboratory of Tourism Information Fusion Processing and Data Ownership Protection, Ministry of Culture and Tourism, Lanzhou University

Technology Information Department, Gansu Provincial Department of Culture and Tourism

School of Computer and Artificial Intelligence, Lanzhou Polytechnical College

Key Laboratory of Artificial Intelligence and Computing Power Technology

Postal code：100079
Tel：（010）53879208、53859533 Email：bdr@bjxintong.com.cn
Technical support is provided by Beijing Founder electronics co., LTD 京ICP备09064830号-19 京公网安备11010802024621
It is recommended to read the content of this site in Chrome&IE9+. Please switch to extreme mode in browser 360.
Cookies We use cookies to help provide and enhance our service and tailor content. By continuing, you agree to the use of cookies.
Total Visits：273493 Visits Today：399

⁰