Enhancing profiles for anomaly detection using time granularities¹

Article type: Research Article

Authors: Li, Yingjiu | Wu, Ningning^{; 2} | Wang, X. Sean | Jajodia, Sushil^{; *}

Affiliations: Center for Secure Information Systems, George Mason University, Fairfax, VA 22030, USA. Tel.: +1 703 993 1653; Fax: +1 703 993 1638; E-mail: yli@ise.gmu.edu, nwu@ise.gmu.edu, xywang@ise.gmu.edu, jajodia@ise.gmu.edu

Correspondence: [*] Corresponding author.

Note: [1] This work was partially supported by the Air Force Research Laboratory/Rome under the contract F 30602-00-2-0512 and the Army Research Office under the contract DAAG-55-98-1-0302. The work of Wang is also supported by NFS with CAREER Award 9875114

Note: [2] Present address: Department of Information Science, University of Arkansas at Little Rock, Little Rock, AR 72204, USA.

Abstract: Recently, association rules have been used to generate profiles of “normal” behavior for anomaly detection. However, the time factor (especially in terms of multiple time granularities) has not been utilized extensively in generation of these profiles. In reality, user behavior during different time intervals may be very different. For example, the “normal” number and duration of FTP connections may vary from working hours to midnight, from business day to weekend or holiday. Furthermore, these variations may depend on the day of the month or the week. This paper proposes to build profiles using temporal association rules in terms of multiple time granularities, and describes algorithms to discover these profiles. Because multiple time granularities are used for the profile generation, the proposed method is more flexible and precise than previous methods that use fixed partition of time intervals. Finally, the paper describes an experiment and its preliminary result on TCP-dump data.

DOI: 10.3233/JCS-2002-101-206

Journal: Journal of Computer Security, vol. 10, no. 1-2, pp. 137-157, 2002