User profiling from network traffic via novel application-level interactions
User profiling from network traffic via novel application-level interactions
复制标题
通过新颖的应用程序级交互从网络流量中进行用户分析
DOI：
10.1109/icitst.2016.7856712
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
Alotibi G
中科院分区：
文献类型：
--
作者：
Alotibi G
内部滥用已成为组织的一个重大问题。传统的信息安全关注的是来自外部而不是员工的威胁。人们已经进行了广泛的研究来开发检测内部人员的方法 - 通常称为数据丢失防护 (DLP) 工具。不幸的是，这些工具的根本限制是它们提供解析为 IP 地址而不是人员的信息。这假设 IP 是静态的并且可链接到个人，但情况通常并非如此。由于设备的移动特性和 IP 地址的动态分配，IP 变得越来越不可靠。本文以之前的工作为基础，提出并研究了一种基于生物识别的行为档案，该档案是通过新颖的特征提取过程创建的，该过程从原始网络流量元数据中识别用户的应用程序级交互（例如，不仅仅是他们正在访问 Facebook，还包括他们是否正在发布、阅读或观看视频）。它还继续描述可以从应用程序导出的各种类型的用户交互。该模型的验证是通过在 2 个月内从 27 名参与者收集 62 GB 元数据来进行的。排名前三的应用程序Skype、Hotmail和BBC的第一名用户识别平均成绩分别为98.1%、96.2%和81.8%。
Insider misuse has become a significant issue for organisations. Traditional information security has focussed upon threats from the outside rather than employees. A wide range of research has been undertaken to develop approaches to detect the insider - often referred to as Data Loss Prevention (DLP) tools. Unfortunately, the fundamental limitation of these tools is that they provide information resolved to IP addresses rather than people. This assumes the IP is static and linkable to an individual, which is often not the case. IPs are increasingly unreliable due to the mobile natural of devices and the dynamic allocation of IP addresses. This paper builds upon prior work to propose and investigate a biometric-based behavioural profile created from a novel feature extraction process that identifies user's application-level interactions (e.g. not simply that they are accessing Facebook but whether they are posting, reading or watching a video) from raw network traffic metadata. It also proceeds to describe various types of user's interactions that can be derived from applications. Validation of the model was conducted by collecting 62 GBs of metadata over a 2 months period from 27 participants. The average results of identifying users at first rank in the top three applications Skype, Hotmail and BBC are scored 98.1%, 96.2% and 81.8% respectively.
登录
查看更多内容
网络流量的取证调查：从网络级元数据派生应用程序级特征的研究
影响因子：
3.7
作者：
Fudong Li;N. Clarke;Gaseb Alotibi;D. Joy
通讯作者：
D. Joy
谷歌文档简介
影响因子：
2.4
作者：
P. Darbyshire;A. Darbyshire
通讯作者：
A. Darbyshire
DOI：
10.1007/3-540-46117-5_48
发表时间：
2002-09
期刊：
Architectures for Networking and Communications Systems
影响因子：
--
作者：
Young H. Cho;S. Navab;W. Mangione-Smith
通讯作者：
Young H. Cho;S. Navab;W. Mangione-Smith
自动化网络取证
DOI：
10.1145/1388969.1389001
发表时间：
2008
期刊：
2015 International Conference on Computer, Communication and Control (IC4)
影响因子：
--
作者：
L. Merkle
通讯作者：
L. Merkle
数据包嗅探器 – 比较特性评估研究
影响因子：
3.7
作者：
O. Awodele;Otusile Oluwabukola;Chibueze Ogbonna;A. Ajayi
通讯作者：
A. Ajayi