Anomaly Detection in Computer Security and an Application to File System Accesses
Anomaly Detection in Computer Security and an Application to File System Accesses
复制标题
DOI：
10.1007/11425274_2
复制
发表时间：
2005-05
期刊：
影响因子：
--
通讯作者：
S. Stolfo;Shlomo Hershkop;Linh H. Bui;Ryan Ferster;Ke Wang
中科院分区：
文献类型：
--
作者：
S. Stolfo;Shlomo Hershkop;Linh H. Bui;Ryan Ferster;Ke Wang
我们提出了一个异常检测在计算机安全的概述，并提供了一个详细的例子，基于主机的入侵检测系统，监视文件系统，以检测异常访问。文件包装器异常检测器（FWRAP）有两个部分，一个是审计文件系统的传感器，另一个是计算这些访问的正常模型的无监督机器学习系统。FWRAP采用我们以前在Windows注册表异常检测工作中报告的概率异常检测（PAD）算法。FWRAP代表了异常检测的一般方法。检测器首先通过操作主机一段时间来训练，并且PAD自动计算特定于目标机器的模型。然后将该模型部署到实时检测器。在本文中，我们描述了用于模型文件系统访问的功能集，以及一组实验的性能结果，使用传感器，同时攻击一个Linux主机与各种恶意软件利用。PAD检测器在某些情况下实现了令人印象深刻的检测率超过95%，并且在异常过程报警时的误报率约为2%。
We present an overview of anomaly detection used in computer security, and provide a detailed example of a host-based Intrusion Detection System that monitors file systems to detect abnormal accesses. The File Wrapper Anomaly Detector (FWRAP) has two parts, a sensor that audits file systems, and an unsupervised machine learning system that computes normal models of those accesses. FWRAP employs the Probabilistic Anomaly Detection (PAD) algorithm previously reported in our work on Windows Registry Anomaly Detection. FWRAP represents a general approach to anomaly detection. The detector is first trained by operating the host computer for some amount of time and a model specific to the target machine is automatically computed by PAD. The model is then deployed to a real-time detector. In this paper we describe the feature set used to model file system accesses, and the performance results of a set of experiments using the sensor while attacking a Linux host with a variety of malware exploits. The PAD detector achieved impressive detection rates in some cases over 95% and about a 2% false positive rate when alarming on anomalous processes.