轻量级主机数据采集与实时异常事件检测方法研究

张剑 1; 童言 1; 徐明迪 2; 秦涛 3

doi:10.7652/xjtuxb201704015

您当前的位置：

首页 >

文章列表页 >

轻量级主机数据采集与实时异常事件检测方法研究

更新时间：2025-07-09

- 轻量级主机数据采集与实时异常事件检测方法研究
- A Method for Data Collection and Real-Time Anomaly Detection of Lightweight Hosts
- 西安交通大学学报 2017年51卷第4期页码：97-102
- 作者机构：
  
  武汉数字工程研究所系统科研部,武汉,430070
- 作者简介：
- 基金信息：
  
  : 2016-06-09。作者简介: 张剑(1979—),男,高级工程师;童言(通信作者),男,博士。基金项目: 国家自然科学基金资助项目(61502438,61672026);陕西省自然科学基金资助项目(2016JM6040);国防预研基金资助项目(B0820132036)
- DOI：10.7652/xjtuxb201704015
  中图分类号： TP393.2
- 网络首发：2017-04-10，
  
  纸质出版：2017
- 稿件说明：
移动端阅览
张剑 1, 童言 1, 徐明迪 2, 等. 轻量级主机数据采集与实时异常事件检测方法研究[J]. 西安交通大学学报, 2017,51(4):97-102.

A Method for Data Collection and Real-Time Anomaly Detection of Lightweight Hosts[J]. 2017, 51(4): 97-102.
张剑 1, 童言 1, 徐明迪 2, 等. 轻量级主机数据采集与实时异常事件检测方法研究[J]. 西安交通大学学报, 2017,51(4):97-102. DOI： 10.7652/xjtuxb201704015.

A Method for Data Collection and Real-Time Anomaly Detection of Lightweight Hosts[J]. 2017, 51(4): 97-102. DOI： 10.7652/xjtuxb201704015.

摘要

针对特征值匹配方法不能检测未知异常的缺点以及常驻采集代理占用大量系统资源的问题

提出一种主机数据采集和异常检测方法。采用智能化的移动代理实现主机数据采集

大幅度降低系统中数据采集代理的数量; 结合实时异常检测的需求

采用主成分分析方法对所收集的主机信息进行维度约减

并采用聚类方法对降维后的数据进行聚类分析

挖掘其中的异常点; 为消除随机异常点对检测结果的影响

采用基于连续时间窗口的主机异常检测方法实现主机异常的准确检测。实验结果表明:与传统方法相比

数据规模相当的情况下

所提方法的时间复杂度减少了50%以上

检测准确率达到了95%以上

适用于主机异常的实时检测。

Abstract

A new method for data collection and anomaly detection of hosts is proposed to focus on the problems that the methods based on signature matching cannot detect unknown anomaly and data collection agents occupy too many host resources. Intelligent mobile agents are employed to perform data collection so that the number of collection agents is greatly reduced. In order to achieve the goal of online anomaly detection

the principal component analysis method is employed to reduce the dimension of the data

and the clustering method is used to mine the abnormal events. The host anomaly detection method based on continuous time windows is adopted to eliminate the influence of random outliers. Experimental results show that the proposed method has lower computational complexity and higher detection accuracy

and for same number of records the time complexity is reduced by more than 50% and the detection accuracy is above 95%

compared with conventional method. It is concluded that the method is suitable for real-time detection of host anomaly.

关键词

Keywords

references

倪桂强, 李佳桢, 潘志松, 等. 基于支持向量数据描述的击键生物特征认证 [J]. 模式识别与人工智能, 2008, 21(5): 704-708.

NI Guiqiang, LI Jiazhen, PAN Zhisong, et al. Verification based on keystroke biologic characteristics using support vector data description [J]. Pattern Recognition and Artificial Intelligence, 2008, 21(5): 704-708.

CAI Zhongmin, SHEN Chao, GUAN Xiaohong. Mitigating behavioral variability for mouse dynamics: a dimensionality reduction method [J]. IEEE Transactions on Human-Machine Systems, 2014, 44(2): 244-255.

PENNINGTON A, STUNK J, GRIFFIN J, et al. Storage based intrusion detection: watching storage activity for suspicious behavior [C]∥Proceedings of the 12th USENIX Security Symposium. New York, USA: ACM, 2003: 137-151.

FORREST S, HOFMEYR A, SOMAYAJI A, et al. A sense of self for UNIX processes [C]∥Proceedings of the 1996 IEEE Symposium on Security and Privacy. Piscataway, NJ, USA: IEEE Communication Society, 1996: 120-128.

李涵, 包立辉. 基于聚类算法的异常入侵检测模型的研究与实现 [J]. 计算机应用与软件, 2006, 23(10): 126-127.

LI Han, BAO Lihui. Research and implementation of an anomaly intrusion detection system model based on cluster analysis [J]. Computer Applications and Software, 2006, 23(10): 126-127.

HAN Sangjun, CHO Sungbae. Rule-based integration of multiple measure-models for effective intrusion detection systems [C]∥Proceedings of the 2003 IEEE International Conference on Man and Cybernetics. Piscataway, NJ, USA: IEEE System, Man and Cybernetics Society, 2003: 120-125.

陶敬, 马小博, 赵娟, 等. 基于资源可用性的主机异常检测 [J]. 电子科技大学学报, 2007, 36(S3): 1449-1452.

TAO Jing, MA Xiaobo, ZHAO Juan, et al. A method for host abnormal detection based on resource availability [J]. Journal of University of Electronic Science and Technology of China, 2007, 36(S3): 1449-1452.

DALMEIJER M, HAMMER D, AERTS A. Mobile software agents [J]. Computers in Industry, 2000, 41(3): 251-260.

IBM. IBM aglets software development kit-home page [EB/OL].(2003-06-23)[2014-05-10]. http: ∥web. media.mit.edu/～stefanm/ibm/AgletsHome Page/index_new4.html.

赵蔷. 主成分分析方法综述 [J]. 软件工程, 2016, 6(19): 1-3.

ZHAO Qiang. A review of principal component analysis [J]. Software Engineering, 2016, 6(19): 1-3.

CAMPELLO R, MOULAVI D, SANDER J. Density based clustering based on hierarchical density estimates [C]∥Proceedings of the 17th Pacific-Asia Conference on Knowledge Discovery in Databases. Berlin, Germany: Springer, 2013: 160-172.

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

全局叶型扭转角误差对轴流压气机性能影响的不确定性量化分析方法

利用程序特征识别降低网格监控负载的研究

自适应滤波实时网络流量异常检测方法

使用交叉熵检测和分类网络异常流量

可演化网络中移动代理的性能分析及优化方法