关键词: Granger因果关系检验, 前兆规则, 因果规则, 攻击检测, 预警

Abstract: The method for attack detection based on Granger Causality Test(GCT) within the framework of temporal data mining was investigated. Through computing causality between a lot of precursors from input time series and a given anomaly from output time series, the method can be used to detect the precursor from datasets containing multivariate time series related to different security regimes of network system, and then produces the precursor rules and causality rules for actual attack detection and early warning with high confidence. Several experiments were conducted to verify the accuracy and precision of the proposed method, and finally its application analysis in attack detection and early warning prototype system was presented.

Key words: Granger Causality Test(GCT), precursor rule, causal rule, attack detection, early warning