利用入侵行为关联性降低异常检测的误报-豆柴文库

您所在位置：网站首页 / 利用入侵行为关联性降低异常检测的误报.docx / 文档详情

在线预览结束，喜欢就下载吧，查找使用更方便

5 金币

下载文档

/ 2

下载提示

如果您无法下载资料，请参考说明：

1、部分资料下载需要金币，请确保您的账户上有足够的金币

2、已购买过的文档，再次下载不重复扣费

3、资料包下载后请先用软件解压，在使用对应软件打开

文本预览

利用入侵行为关联性降低异常检测的误报
Title:ReducingFalsePositivesinAnomalyDetectionthroughIntrusionBehaviorCorrelation
Abstract:
Anomalydetectionplaysacrucialroleinidentifyingandmitigatingsecuritythreatswithincomputernetworks.However,traditionalanomalydetectionsystemsoftensufferfromhighfalsepositives,whichleadstoasignificantincreaseintheworkloadofsecuritypersonnelandreducestheeffectivenessofthesystem.Toaddressthisissue,thispaperproposesanovelapproachthatintegratesintrusionbehaviorcorrelationtechniquestoreducetheoccurrenceoffalsepositivesinanomalydetectionsystems.
1.Introduction
Anomalydetectionisacriticalcomponentofcybersecurity,aimingtoidentifyanyabnormalorsuspiciousactivitieswithinacomputernetwork.However,thedetectionofanomaliesoftenresultsinahighnumberoffalsepositives,whichoverwhelmssecurityanalystsandhamperstheirabilitytoidentifyrealthreats.Inthispaper,weexplorehowincorporatingintrusionbehaviorcorrelationtechniquescanimprovetheaccuracyofanomalydetectionsystemsandreducefalsepositives.
2.Background
2.1AnomalyDetectionTechniques
2.2IntrusionBehaviorCorrelation
2.3ChallengesinAnomalyDetectionandFalsePositives
3.ProposedApproach
3.1DataPreprocessingandFeatureExtraction
3.2IntrusionBehaviorCorrelation
3.3AnomalyDetectionModel
3.4IntegrationofIntrusionBehaviorCorrelationandAnomalyDetection
4.ExperimentalSetup
4.1DatasetDescription
4.2EvaluationMetrics
4.3BaselineAnomalyDetectionSystem
4.4ProposedApproachImplementation
5.ResultsandAnalysis
5.1ComparisonwithBaselineSystem
5.2ReductioninFalsePositives
5.3DetectionPerformanceMetrics
6.Discussion
6.1AdvantagesofIntrusionBehaviorCorrelation
6.2LimitationsandChallenges
6.3PotentialImprovements
7.RelatedWork
7.1AnomalyDetectionTechniques
7.2IntrusionBehaviorCorrelationTechniques
7.3IntegrationofIntrusionBehaviorCorrelationinAnomalyDetection
8.Conclusion
Thispaperproposedaninnovativeapproachtoreducefalsepositivesinanomalydetectionsystemsbyintegratingintrusionbehaviorcorrelationtechniques.Theexperimentalresultsdemonstratedtheeffectivenessofthepro