A FRAMEWORK OF DATA MINING BASED INSIDERS ANOMALY DETECTION MODEL FOR CORPORATION NETWORK

摘要

In the rapid growth of Web-based information system has made security become a critical requirement for operating and managing a corporation network. Statistics show that 75 percent attacks come from the inside of an organization, thus protecting the system from inside attacks is a continuously challenge. In order to develop a systematic and automated approach in performing insiders anomaly detection, this paper presents a framework of Behavior Pattern Mining and Analysis Model (BPMA) . In BPMA, we apply data mining algorithms to establish historical individual patterns, then abstract the historical group behavior patterns from historical individual patterns based on an attribute concept hierarchy tree. These patterns are used in online inside attacks detection. BPMA is composed of four modules: preprocessing engine, mining engine, matching engine and manual analyzing engine.