Abnormal user detection in enterprise network based on graph analysis and support vector machine

doi:10.11772/j.issn.1001-9081.2017081951

Journal of Computer Applications ›› 2018, Vol. 38 ›› Issue (2): 357-362.DOI: 10.11772/j.issn.1001-9081.2017081951

Previous Articles Next Articles

Abnormal user detection in enterprise network based on graph analysis and support vector machine

XU Bing^1,2, GUO Yuanbo^1,2, YE Ziwei^1,2, HU Yongjin^1,2

1. Information Engineering University, Zhengzhou Henan 450001, China;
2. State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou Henan 450001, China

Received:2017-08-09 Revised:2017-09-30 Online:2018-02-10 Published:2018-02-10
Supported by:
This work is partially supported by National Natural Science Foundation of China (61602515).

基于图分析和支持向量机的企业网异常用户检测

徐兵^1,2, 郭渊博^1,2, 叶子维^1,2, 胡永进^1,2

1. 信息工程大学, 郑州 450001;
2. 数学工程与先进计算国家重点实验室, 郑州 450001

通讯作者: 徐兵
作者简介:徐兵(1993-),男,河南驻马店人,硕士研究生,主要研究方向:机器学习、信息安全;郭渊博(1975-),男,陕西周至人,教授,博士生导师,博士,主要研究方向:信息安全、态势感知;叶子维(1990-),男,吉林通化人,博士研究生,主要研究方向:信息安全、漏洞挖掘;胡永进(1981-),男,山东潍坊人,博士研究生,主要研究方向:机器学习、信息安全。
基金资助:
国家自然科学基金资助项目（61602515）。

Abstract

Abstract: In the enterprise network, if the internal attacker obtains the user's identity authentication information, his behavior will be very difficult to distinguish with the normal user. The current research on the abnormal user detection method in enterprise network is relatively simple and the detection rate is low. The user's authentication activity information directly reflects the user's interaction with various resources or personnel in the network. Based on this, a new abnormal user detection method by using user authentication activity information was proposed. The user's authentication activity was used to generate the user authentication graph, and then the attributes in the authentication graph were extracted based on the graph analysis method, such as the size of the largest connected components of the graph and the number of isolated certificates. These attributes reflect the user's authentication behavioral characteristics in the enterprise network. Finally, a supervised Support Vector Machine (SVM) was used to model the extracted graph attributes to indirectly identify and detect abnormal users in the network. After extracting the user graph vector, the training set and the test set, the penalty parameter and the kernel function were analyzed by taking different values. Through the adjustment of these parameters, the recall, accuracy and F1-Score of the propsed method have reached more than 80%. The experimental results show that the proposed method can effectively detect abnormal users in the enterprise network.

Key words: user authentication, anomaly detection, graph analysis, Support Vector Machine (SVM), authentication graph

摘要： 在企业网络中，若其内部的攻击者获得了用户的身份认证信息，其行为与正常用户将很难区分；而目前研究对于企业网中的异常用户检测方法比较单一，召回率不高。用户的认证活动信息直接反映了用户在网络中与各类资源或人员的交互，基于此，提出一种利用用户认证活动信息来检测网络中异常用户的方法。该方法利用用户的认证活动生成用户认证图，之后基于图分析方法提取认证图中的属性，如图的最大连通组件的大小、孤立认证的数量等，这些属性反映了用户在企业网中的认证行为特征。最后利用有监督的支持向量机（SVM）对提取到的图属性进行建模，以此来间接识别和检测网络中的异常用户。在提取了用户图向量之后，具体对训练集和测试集、惩罚参数、核函数取不同值的情况进行了分析。通过对这些参数的调节，召回率、精确率和F1-Score均达到80%以上。实验数据表明，该方法能够有效检测企业网络中的异常用户。

关键词: 用户认证, 异常检测, 图分析, 支持向量机, 认证图

CLC Number:

TP309

XU Bing, GUO Yuanbo, YE Ziwei, HU Yongjin. Abnormal user detection in enterprise network based on graph analysis and support vector machine[J]. Journal of Computer Applications, 2018, 38(2): 357-362.

徐兵, 郭渊博, 叶子维, 胡永进. 基于图分析和支持向量机的企业网异常用户检测[J]. 计算机应用, 2018, 38(2): 357-362.

References

[1] JIANG P, WEN Q, LI W, et al. An anonymous and efficient remote biometrics user authentication scheme in a multi server environment[J]. Frontiers of Computer Science, 2015, 9(1):142-156.
[2] 王英,向碧群.基于用户行为的入侵检测系统[J].计算机工程,2008,34(9):167-169. (WANG Y, XIANG B Q. Intrusion detection system based on user behavior[J]. Computer Engineering, 2009, 34(9):167-169.)
[3] 王平,汪定,黄欣沂.口令安全研究进展[J].计算机研究与发展,2016,53(10):2173-2188. (WANG P, WANG D, HUANG X Y. Advances in password security[J]. Journal of Computer Research and Development, 2008, 34(9):167-169.)
[4] HE D, WANG D. Robust biometric-based authentication scheme for multiserver environment[J]. IEEE Systems Journal, 2015, 9(3):816-823.
[5] WANG D, WANG P. Two birds with one stone:two-factor authentication with security beyond conventional bound[J]. IEEE Transactions on Dependable and Secure Computing, 2016(99):1-22.
[6] KENT A D, LIEBROCK L M. Differentiating user authentication graphs[C]//SPW'13:Proceedings of the 2013 IEEE Security and Privacy Workshops. Washington, DC:IEEE Computer Society, 2013:72-75.
[7] JOHNSON A, DEMPSEY K, ROSS R, et al. Guide for security configuration management of information systems[EB/OL].[2017-03-06]. http://www.gocs.eu/pages/fachberichte/archiv/045-draft_sp800-128-ipd.pdf.
[8] AGARWAL N, SACHS E, KONG G, et al. Central account manager:US, US8789147[P]. 2014-07-22.
[9] 赛迪网.2016网络安全大事件[R/OL].[2018-08-01]. http://www.ccidnet.com/2016/0801/10162993.shtml. (CCIDNET. Network security big event of 2016.[R/OL].[2016-08-01]. http://www.ccidnet.com/2016/0801/10162993.shtml.)
[10] 启明星辰yepeng.八大典型APT攻击过程详解[R/OL]. (2013-08-27)[2017-01-15]. http://netsecurity.51cto.com/art/201308/408470.htm. (YE P. 8 typical APT attack process analysis in detail[R/OL]. (2013-08-27)[2017-01-15]. http://netsecurity.51cto.com/art/201308/408470.htm.)
[11] KENT A D, LIEBROCK L M, NEIL J C. Authentication graphs:analyzing user behavior within an enterprise network[J]. Computers & Security, 2015, 48:150-166.
[12] JAVED M. Detecting credential compromise in enterprise networks[D]. Berkeley:University of California, Electrical Engineering and Computer Sciences, 2016.
[13] 饶鲜,董春曦,杨绍全.基于支持向量机的入侵检测系统[J].软件学报,2003,14(4):798-803. (RAO X, DONG C X, YANG S Q. An intrusion detection system based on support vector machine[J]. Journal of Software, 2003, 14(4):798-803.)
[14] CHITRAKAR R, HUANG C. Selection of candidate support vectors in incremental SVM for network intrusion detection[J]. Computers & Security, 2014, 45:231-241.
[15] 何大韧,刘宗华,汪秉宏,等.复杂网络与系统[M].北京:高等教育出版社,2009:148. (HE D R, LIU Z H, WANG B H, et al. Complex Networks and Systems[M].Beijing:Higher Education Press, 2009:148.)
[16] KENT A D. Cyber security data sources for dynamic network research[M]//Networks and Cyber-Security. River Edge, NJ:World Scientific Publishing Company, 2016:37-65.
[17] 周志华,杨强.机器学习及其应用[M].北京:清华大学出版社,2011:95. (ZHOU Z H, YANG Q. Statistical Learning Method[M]. Beijing:Tsinghua University Press, 2011:95.)

Abnormal user detection in enterprise network based on graph analysis and support vector machine

基于图分析和支持向量机的企业网异常用户检测

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics

[1]	HU Tianjie, HU Wenjun, WANG Shitong. Distribution entropy penalized support vector data description [J]. Journal of Computer Applications, 2021, 41(8): 2212-2218.
[2]	XIE Yu, JIANG Yu, LONG Chaoqi. Extended isolation forest algorithm based on random subspace [J]. Journal of Computer Applications, 2021, 41(6): 1679-1685.
[3]	YAO Jie, CHENG Chunling, HAN Jing, LIU Zheng. Anomaly detection method based on multi-task temporal convolutional network in cloud workflow [J]. Journal of Computer Applications, 2021, 41(6): 1701-1708.
[4]	LI Yanzhi, FAN Yong, GAO Lin. Anomaly detection of oil drilling water flow based on shape flow [J]. Journal of Computer Applications, 2021, 41(6): 1842-1848.
[5]	JIA Heming, JIANG Zichao, LI Yao, SUN Kangjian. Simultaneous feature selection optimization based on improved spotted hyena optimizer algorithm [J]. Journal of Computer Applications, 2021, 41(5): 1290-1298.
[6]	YUAN Qianqian, DENG Hongmin, WANG Xiaohang. Citrus disease and insect pest area segmentation based on superpixel fast fuzzy C-means clustering and support vector machine [J]. Journal of Computer Applications, 2021, 41(2): 563-570.
[7]	Kai LI, Jie LI. Structure-fuzzy multi-class support vector machine algorithm based on pinball loss [J]. Journal of Computer Applications, 2021, 41(11): 3104-3112.
[8]	TONG Lin, GUAN Zheng. Fuzzy granulation prediction of traffic flow based on improved whale optimization support vector machine [J]. Journal of Computer Applications, 2021, 41(10): 2919-2927.
[9]	WANG Lei. Network intrusion detection method based on improved rough set attribute reduction and K-means clustering [J]. Journal of Computer Applications, 2020, 40(7): 1996-2002.
[10]	HU Min, BAI Xue, XU Wei, WU Bingjian. Review of anomaly detection algorithms for multidimensional time series [J]. Journal of Computer Applications, 2020, 40(6): 1553-1564.
[11]	ZHANG Jianming, SHI Yuanhao, XU Zhengyi, WEI Jianming. Adaptive UWB/PDR fusion positioning algorithm based on error prediction [J]. Journal of Computer Applications, 2020, 40(6): 1755-1762.
[12]	QIU Yuan, Chang Xiangmao, QIU Qian, PENG Cheng, SU Shanting. Stream data anomaly detection method based on long short-term memory network and sliding window [J]. Journal of Computer Applications, 2020, 40(5): 1335-1339.
[13]	HUO Weigang, WANG Huifang. Time series anomaly detection method based on autoencoder and HMM [J]. Journal of Computer Applications, 2020, 40(5): 1329-1334.
[14]	WANG Yang, ZHAO Hongdong. Human activity recognition based on improved particle swarm optimization-support vector machine and context-awareness [J]. Journal of Computer Applications, 2020, 40(3): 665-671.
[15]	LI Hui, YANG Zhixia. Multiple birth support vector machine based on Rescaled Hinge loss function [J]. Journal of Computer Applications, 2020, 40(11): 3139-3145.