Publication Type
Journal Article
Version
publishedVersion
Publication Date
1-2002
Abstract
Recently, association rules have been used to generate profiles of normal behavior for anomaly detection. However, the time factor (especially in terms of multiple time granularities) has not been utilized extensively in generation of these profiles. In reality, user behavior during different time intervals may be very different. For example, the normal number and duration of FTP connections may vary from working hours to midnight, from business day to weekend or holiday. Furthermore, these variations may depend on the day of the month or the week. This paper proposes to build profiles using temporal association rules in terms of multiple time granularities, and describes algorithms to discover these profiles. Because multiple time granularities are used for the profile generation, the proposed method is more flexible and precise than previous methods that use fixed partition of time intervals. Finally, the paper describes an experiment and its preliminary result on TCP-dump data.
Discipline
Information Security
Research Areas
Cybersecurity
Publication
Journal of Computer Security
Volume
10
Issue
1/2
First Page
137
Last Page
157
ISSN
0926-227X
Identifier
10.3233/JCS-2002-101-206
Publisher
IOS Press
Citation
LI, Yingjiu; WU, Ningning; WANG, X. Sean; and JAJODIA, Sushil.
Enhancing Profiles for Anomaly Detection Using Time Granularities. (2002). Journal of Computer Security. 10, (1/2), 137-157.
Available at: https://ink.library.smu.edu.sg/sis_research/161
Copyright Owner and License
Authors
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.
Additional URL
https://doi.org/10.3233/JCS-2002-101-206