论文标题
使用NetFlow数据的广义内部攻击检测实现
Generalized Insider Attack Detection Implementation using NetFlow Data
论文作者
论文摘要
商业网络中的内部攻击检测是一个关键问题，目前没有任何好的解决方案。由于缺乏对实时网络的知名度以及缺乏区分不同攻击的标准功能，因此问题是具有挑战性的。在本文中，我们研究了一种以使用网络数据来识别攻击的方法。我们的工作建立在无监督的机器学习技术的基础上，例如一级SVM和Bi-Clustering作为内部网络攻击的弱指标。我们将这些技术结合起来，将误报数量限制为现实部署所需的可接受的水平，通过使用一级SVM检查提议的BI-CRUSTUSTER算法检测到的异常。我们提出了Python中的原型实现，并为两个不同的现实世界代表性数据集提供了相关的结果。我们表明，我们的方法是在现实设置中进行内部攻击检测的有前途的工具。
Insider Attack Detection in commercial networks is a critical problem that does not have any good solutions at this current time. The problem is challenging due to the lack of visibility into live networks and a lack of a standard feature set to distinguish between different attacks. In this paper, we study an approach centered on using network data to identify attacks. Our work builds on unsupervised machine learning techniques such as One-Class SVM and bi-clustering as weak indicators of insider network attacks. We combine these techniques to limit the number of false positives to an acceptable level required for real-world deployments by using One-Class SVM to check for anomalies detected by the proposed Bi-clustering algorithm. We present a prototype implementation in Python and associated results for two different real-world representative data sets. We show that our approach is a promising tool for insider attack detection in realistic settings.
