An abnormal file access behavior detection approach based on file path diversity
An abnormal file access behavior detection approach based on file path diversity
复制标题
DOI：
10.1049/cp.2014.0632
复制
发表时间：
2014-05
期刊：
影响因子：
--
通讯作者：
Xiaobin Wang;Yonglin Sun;Yongjun Wang
中科院分区：
文献类型：
--
作者：
Xiaobin Wang;Yonglin Sun;Yongjun Wang
在现代信息世界中，信息安全是组织面临的巨大挑战。现有的防火墙、入侵检测系统和防病毒等安全设施不足以保证信息的安全。文件是信息的重要载体，是许多攻击者的目的，本文提出了一种基于fpd的异常文件访问行为检测方法。FPD （File Path Diversity，文件路径多样性）是一个量化值，用来衡量一组文件路径的分布范围，其中异常的文件访问行为与正常的文件访问行为存在显著差异，是检测攻击者控制的恶意进程搜索和窃取有价值文件的有效指标。提出了一种计算FPD值的算法，并给出了一个基于FPD的恶意进程检测原型系统。实验表明，FPD在检测具有异常文件访问行为的恶意进程方面非常有效，检测率为100%，误报率为3.85%。
Information security is a great challenge for organizations in our modern information world. Existing security facilities like Firewalls, Intrusion Detection Systems and Antivirus are not enough to guarantee the security of information. File is an important carrier of information, which is the intent of quite a number of attackers, in this paper, we propose an FPD-based approach for detecting abnormal file access behaviours. FPD (File Path Diversity) is a quantized value which measures how far a set of file paths is spread out, and in which abnormal file access behaviours and normal ones show significant differences, making it an effective indicator for detecting malicious processes that controlled by attackers to search and steal valuable files. An algorithm of calculating FPD values is presented, as well as a prototype system based on FPD for detecting malicious processes. Experiments demonstrate that FPD is very effective in detecting malicious processes with abnormal file access behaviours, we get a best result of a 100% Detection Rate and a 3.85% False Positive Rate.