A Method for Data Collection and Real-Time Anomaly Detection of Lightweight Hosts

doi:10.7652/xjtuxb201704015

您当前的位置：

首页 >

文章列表页 >

A Method for Data Collection and Real-Time Anomaly Detection of Lightweight Hosts

更新时间：2025-07-09

- A Method for Data Collection and Real-Time Anomaly Detection of Lightweight Hosts
- Vol. 51, Issue 4, Pages: 97-102(2017)
- 作者机构：
  
  武汉数字工程研究所系统科研部,武汉,430070
- 作者简介：
- 基金信息：
- DOI：10.7652/xjtuxb201704015
  CLC： TP393.2
- Online First：10 April 2017，
  
  Published：2017
- 稿件说明：
移动端阅览
A Method for Data Collection and Real-Time Anomaly Detection of Lightweight Hosts[J]. 2017, 51(4): 97-102.
DOI：

A Method for Data Collection and Real-Time Anomaly Detection of Lightweight Hosts[J]. 2017, 51(4): 97-102. DOI： 10.7652/xjtuxb201704015.

摘要

针对特征值匹配方法不能检测未知异常的缺点以及常驻采集代理占用大量系统资源的问题

提出一种主机数据采集和异常检测方法。采用智能化的移动代理实现主机数据采集

大幅度降低系统中数据采集代理的数量; 结合实时异常检测的需求

采用主成分分析方法对所收集的主机信息进行维度约减

并采用聚类方法对降维后的数据进行聚类分析

挖掘其中的异常点; 为消除随机异常点对检测结果的影响

采用基于连续时间窗口的主机异常检测方法实现主机异常的准确检测。实验结果表明:与传统方法相比

数据规模相当的情况下

所提方法的时间复杂度减少了50%以上

检测准确率达到了95%以上

适用于主机异常的实时检测。

Abstract

A new method for data collection and anomaly detection of hosts is proposed to focus on the problems that the methods based on signature matching cannot detect unknown anomaly and data collection agents occupy too many host resources. Intelligent mobile agents are employed to perform data collection so that the number of collection agents is greatly reduced. In order to achieve the goal of online anomaly detection

the principal component analysis method is employed to reduce the dimension of the data

and the clustering method is used to mine the abnormal events. The host anomaly detection method based on continuous time windows is adopted to eliminate the influence of random outliers. Experimental results show that the proposed method has lower computational complexity and higher detection accuracy

and for same number of records the time complexity is reduced by more than 50% and the detection accuracy is above 95%

compared with conventional method. It is concluded that the method is suitable for real-time detection of host anomaly.

关键词

Keywords

references

倪桂强, 李佳桢, 潘志松, 等. 基于支持向量数据描述的击键生物特征认证 [J]. 模式识别与人工智能, 2008, 21(5): 704-708.

NI Guiqiang, LI Jiazhen, PAN Zhisong, et al. Verification based on keystroke biologic characteristics using support vector data description [J]. Pattern Recognition and Artificial Intelligence, 2008, 21(5): 704-708.

CAI Zhongmin, SHEN Chao, GUAN Xiaohong. Mitigating behavioral variability for mouse dynamics: a dimensionality reduction method [J]. IEEE Transactions on Human-Machine Systems, 2014, 44(2): 244-255.

PENNINGTON A, STUNK J, GRIFFIN J, et al. Storage based intrusion detection: watching storage activity for suspicious behavior [C]∥Proceedings of the 12th USENIX Security Symposium. New York, USA: ACM, 2003: 137-151.

FORREST S, HOFMEYR A, SOMAYAJI A, et al. A sense of self for UNIX processes [C]∥Proceedings of the 1996 IEEE Symposium on Security and Privacy. Piscataway, NJ, USA: IEEE Communication Society, 1996: 120-128.

李涵, 包立辉. 基于聚类算法的异常入侵检测模型的研究与实现 [J]. 计算机应用与软件, 2006, 23(10): 126-127.

LI Han, BAO Lihui. Research and implementation of an anomaly intrusion detection system model based on cluster analysis [J]. Computer Applications and Software, 2006, 23(10): 126-127.

HAN Sangjun, CHO Sungbae. Rule-based integration of multiple measure-models for effective intrusion detection systems [C]∥Proceedings of the 2003 IEEE International Conference on Man and Cybernetics. Piscataway, NJ, USA: IEEE System, Man and Cybernetics Society, 2003: 120-125.

陶敬, 马小博, 赵娟, 等. 基于资源可用性的主机异常检测 [J]. 电子科技大学学报, 2007, 36(S3): 1449-1452.

TAO Jing, MA Xiaobo, ZHAO Juan, et al. A method for host abnormal detection based on resource availability [J]. Journal of University of Electronic Science and Technology of China, 2007, 36(S3): 1449-1452.

DALMEIJER M, HAMMER D, AERTS A. Mobile software agents [J]. Computers in Industry, 2000, 41(3): 251-260.

IBM. IBM aglets software development kit-home page [EB/OL].(2003-06-23)[2014-05-10]. http: ∥web. media.mit.edu/～stefanm/ibm/AgletsHome Page/index_new4.html.

赵蔷. 主成分分析方法综述 [J]. 软件工程, 2016, 6(19): 1-3.

ZHAO Qiang. A review of principal component analysis [J]. Software Engineering, 2016, 6(19): 1-3.

CAMPELLO R, MOULAVI D, SANDER J. Density based clustering based on hierarchical density estimates [C]∥Proceedings of the 17th Pacific-Asia Conference on Knowledge Discovery in Databases. Berlin, Germany: Springer, 2013: 160-172.

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Uncertainty Quantification Method on the Influence of Global Blade Twist Angle Errors on Axial Compressor Performance

Reducing the Grid Monitoring Workload Using Application Characteristics Identification

On-Line Anomaly Detection Method for Network Traffic Based on Adaptive Filtering

Using Cross Entropy to Detect and Classify Network Anomalous Traffic

Performance Analysis and Optimization for Mobile Agents in Evolutionary Network

Related Author

SHEN Yihao

MO Yuqin

LIU Kaiye

CHU Wuli

ZHAI Yichen

钱德沛 1

王克 2

Related Institution

School of Power and Energy, Northwestern Polytechnical University

School of Electronics and Information Engineering, Xi'an Jiaotong University

School of nformation Science, Guangdong Ocean University

School of Information Science, Guangdong Ocean University

Shenzhen Institutes of Advanced Technology, Chinese Academy of Sciences

⁰