Method for self-adapting testing access of abnormal files

Abstract

The method includes following steps: (1) recording request of accessing file resources generated in computer system in real time; (2) carrying out pretreatment for the recorded requests; (3) using relation tree of file access records relation of file access described in access records of normal files; (4) relation tree of file access is divided into two parts of fixed part and variation part based on rarity of time t-Rarity; (5) analyzing records of file access, and selecting normal actions of file access, and reporting abnormal actions of file access to safety officer; (6) updating relation tree of file access periodically, and deleting out outdated relation of file access recorded in relation tree of file access. Mechanisms of selective self-learning and self-adapting forgetting are adopted in the invention. Thus, safe and reliable normal action model is built automatically without manual intervention. The invention detects lots of malicious acts with high precision.

Description

Technical field [0001] The invention relates to the technical field of computer network security, in particular to an adaptive detection method for abnormal file access. Background technique [0002] The widespread use of the Internet has increased the risk of networked computers being attacked. Practice has proven that traditional defensive security measures such as passwords, firewalls, and information encryption are not sufficient to cope with this increasingly severe new security situation. In practice, there is an urgent need for safeguard measures that can dynamically monitor the security of networked computer systems like intrusion detection technology, so as to respond quickly in the event of an attack and minimize the possible loss. Therefore, a large number of intrusion detection systems (IDS) have been put into practical use and have become an essential part of most organizations' security systems. Intrusion detection technologies are mainly divided into two types: mis...

AI Technical Summary

Problems solved by technology

[0005] However, due to the complexity and time-varying nature of file access in actual systems, researchers have not been able to propose a comprehensive and effective method for detecting illegal behavior in systems based on file access.

In April 2003, Columbia's research team first described a Bayesian model-based system for detecting abnormal behavior in file access, FWRAP (File Wrapper Anomaly Detection System), in their technical report, but the detection accuracy of the system is not high, and the memory overhead Huge, especially when normal model training still requires a large amount of high-quality normal data, so the system can only be used as a research prototype and is not practical

Images