HMMs based masquerade detection for network security on with parallel computing

doi:10.1016/j.comcom.2020.03.048

CORC > 计算技术研究所 > 中国科学院计算技术研究所 > 中国科学院计算技术研究所期刊论文 > 英文

	HMMs based masquerade detection for network security on with parallel computing
	Liu, Jia 1,2; Duan, Miyi 1; Li, Wenfa 3; Tian, Xinguang 4
刊名	COMPUTER COMMUNICATIONS
	2020-04-15
卷号	156 页码:168-173
关键词	Masquerade detection Shell command Anomaly detection Hidden Markov model
ISSN号	0140-3664
DOI	10.1016/j.comcom.2020.03.048
英文摘要	Masquerade detection is currently an active research topic in the field of network security. This paper presents a novel method for detecting masquerade attacks based on hidden Markov models (HMMs), which applies to host-based intrusion detection systems using Unix or Linux shell commands as audit data. The method employs multiple command sequences of different lengths to represent the behavioral patterns of a legitimate user and constructs a specific HMM to characterize the normal behavior profile of the user. Moreover, the adaptability and precision of user profiling are definitely taken into account. During training, the parameters of the HMM are calculated by parallel computing that is less computationally expensive than the classic Baum-Welch algorithm. At the detection stage, the occurrence probabilities of short state sequences are first computed to analyze behavior deviations that may indicate masquerade attacks, and two alternative decision schemes can be used to classify the monitored user's behavior as normal or anomalous. The method addresses both detection accuracy and computational efficiency and is especially suitable for online detection. Our study empirically demonstrates the promising performance of the method.
资助项目	National Natural Science Foundation of China[61841601] ; Science and Technology Projects of Beijing Municipal Education Commission, China[KM201911417011] ; Premium Funding Project for Academic Human Resources Development in Beijing Union University, China[BPHR2018EZ01]
WOS研究方向	Computer Science ; Engineering ; Telecommunications
语种	英语
出版者	ELSEVIER
WOS记录号	WOS:000528265900016
内容类型	期刊论文
源URL	[http://119.78.100.204/handle/2XEOYT63/15431]
专题	中国科学院计算技术研究所期刊论文_英文
通讯作者	Duan, Miyi; Li, Wenfa
作者单位	1.Beihang Univ, Sch Comp Sci & Engn, Beijing Key Lab Digital Media, Beijing, Peoples R China 2.Beijing Union Univ, Smart City Coll, Beijing, Peoples R China 3.Beijing Union Univ, Coll Robot, Beijing, Peoples R China 4.Chinese Acad Sci, Inst Comp Technol, Beijing, Peoples R China
推荐引用方式 GB/T 7714	Liu, Jia,Duan, Miyi,Li, Wenfa,et al. HMMs based masquerade detection for network security on with parallel computing[J]. COMPUTER COMMUNICATIONS,2020,156:168-173.
APA	Liu, Jia,Duan, Miyi,Li, Wenfa,&Tian, Xinguang.(2020).HMMs based masquerade detection for network security on with parallel computing.COMPUTER COMMUNICATIONS,156,168-173.
MLA	Liu, Jia,et al."HMMs based masquerade detection for network security on with parallel computing".COMPUTER COMMUNICATIONS 156(2020):168-173.