An Immunity-Based Anomaly Detection System with Sensor Agents
An Immunity-Based Anomaly Detection System with Sensor Agents
复制标题
DOI：
10.3390/s91109175
复制
发表时间：
2009-11-01
期刊：
影响因子：
3.9
通讯作者：
Ishida, Yoshiteru
中科院分区：
文献类型：
--
作者：
Okamoto, Takeshi;Ishida, Yoshiteru
基于免疫系统的特异性和多样性，提出了一种基于免疫的传感器agent异常检测系统。每个代理都专门对特定用户的行为作出反应。多个不同的主体决定行为是正常还是异常。传统系统仅使用单个传感器来检测异常，而基于免疫的系统使用多个传感器，从而提高了检测精度。此外，我们还提出了异常检测系统的评估框架，该框架能够评估内部和外部异常检测精度的差异。本文主要研究类unix系统中用户命令序列的异常检测。在实验中，基于免疫的系统比一些最好的传统系统表现得更好。
This paper proposes an immunity-based anomaly detection system with sensor agents based on the specificity and diversity of the immune system. Each agent is specialized to react to the behavior of a specific user. Multiple diverse agents decide whether the behavior is normal or abnormal. Conventional systems have used only a single sensor to detect anomalies, while the immunity-based system makes use of multiple sensors, which leads to improvements in detection accuracy. In addition, we propose an evaluation framework for the anomaly detection system, which is capable of evaluating the differences in detection accuracy between internal and external anomalies. This paper focuses on anomaly detection in user's command sequences on UNIX-like systems. In experiments, the immunity-based system outperformed some of the best conventional systems.