Frequent pattern based user behavior anomaly detection for cloud system

Chien Yi Chiu, Chi Tien Yeh, Yuh-Jye Lee

Research output: Contribution to conferencePaperpeer-review

10 Scopus citations

Abstract

Cloud Computing is a hot topic in the global IT industry, which is considered as the main part of the network and computing service provider in recent years. Some security issues will be more threatening in cloud computing, such as account theft and insider threat. We propose a framework to utilize anomaly detection and random re-sampling techniques for profiling user's behaviors via the frequent patterns of activated system processes. By utilizing the user profiles learned from normal data, our method can detect malicious activities and discriminate suspicious activities from different users. We use virtual machine (VM) to collect process log of normal users and malicious tools. The collected data is used on verifying if our method can detect the malicious activities on the system. The results show that all the malicious activities are detected with less than 4.6% false-positive rate. We also collect real-world data for testing the ability of discriminating activities collected from different users. The results showed that the user profiles can averagely detect 86% suspicious behaviors from different users with less than 1% false positive rate.

Original languageEnglish
Pages61-66
Number of pages6
DOIs
StatePublished - 1 Jan 2013
Event2013 Conference on Technologies and Applications of Artificial Intelligence, TAAI 2013 - Taipei, Taiwan
Duration: 6 Dec 20138 Dec 2013

Conference

Conference2013 Conference on Technologies and Applications of Artificial Intelligence, TAAI 2013
CountryTaiwan
CityTaipei
Period6/12/138/12/13

Keywords

  • Data Mining
  • Information Security
  • Machine learning

Fingerprint Dive into the research topics of 'Frequent pattern based user behavior anomaly detection for cloud system'. Together they form a unique fingerprint.

Cite this