Journal
INFORMATION AND COMPUTER SECURITY
Volume 30, Issue 1, Pages 19-36Publisher
EMERALD GROUP PUBLISHING LTD
DOI: 10.1108/ICS-12-2019-0142
Keywords
Hidden Markov model; Insider threat detection; Viterbi algorithm; Anomaly detection
Categories
Funding
- Basic Science Research Program through the National Research Foundation of Korea (NRF) - Ministry of Education [NRF-2015R1D1A1A01060874]
Ask authors/readers for more resources
This paper proposes a new feature extraction method and analysis mode that determines the shape of the hidden state according to the situation of the data set, making subsequent HMM modeling simple and efficient, thereby improving the accuracy of user behavior detection.
Purpose By using a new feature extraction method on the Cert data set and using a hidden Markov model (HMM) to model and analyze the behavior of users to distinguish whether the behavior is normal within a continuous period. Design/methodology/approach Feature extraction of five parts of the time series by rules and sorting in chronological order. Use the obtained features to calculate the probability parameters required by the HMM model and establish a behavior model for each user. When the user has abnormal behavior, the model will return a very low probability value to distinguish between normal and abnormal information. Findings Generally, HMM parameters are obtained by supervised learning and unsupervised learning, but the hidden state cannot be clearly defined. When the hidden state is determined according to the data set, the accuracy of the model will be improved. Originality/value This paper proposes a new feature extraction method and analysis mode, which determines the shape of the hidden state according to the situation of the data set, making subsequent HMM modeling simple and efficient and in turn improving the accuracy of user behavior detection.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available