关键词: 伪装攻击, 入侵检测, shell命令, 数据挖掘, 异常检测

Abstract:

Host-based intrusion detection acts as one of the major directions of research in network security. This
paper presents a novel method for masquerade detection based on data mining and variable-length shell command
sequence matching, which is applicable to intrusion detection systems using shell commands as audit data on Unix
and Linux platforms. The method employs multiple command sequences to represent user behavior pattern, and
utilizes sequence supports defined in data mining technique to characterize the normal behavior profiles of legitimate
users. In the detection stage, a model based on variable-length shell command sequence matching and decision
value weighing is used to distinguish between legitimate users and masqueraders, while the particularity of audit
data and user behavior is taken into account. The performance of the method is tested by computer simulation, and
the results show it can achieve higher detection accuracy and efficiency than existing alternative methods.

Key words: masquerade attack, intrusion detection, shell command, data mining, anomaly detection