Title

Enhancing Profiles for Anomaly Detection Using Time Granularities

Publication Type

Journal Article

Publication Date

2002

Abstract

Recently, association rules have been used to generate profiles of normal behavior for anomaly detection. However, the time factor (especially in terms of multiple time granularities) has not been utilized extensively in generation of these profiles. In reality, user behavior during different time intervals may be very different. For example, the normal number and duration of FTP connections may vary from working hours to midnight, from business day to weekend or holiday. Furthermore, these variations may depend on the day of the month or the week. This paper proposes to build profiles using temporal association rules in terms of multiple time granularities, and describes algorithms to discover these profiles. Because multiple time granularities are used for the profile generation, the proposed method is more flexible and precise than previous methods that use fixed partition of time intervals. Finally, the paper describes an experiment and its preliminary result on TCP-dump data.

Discipline

Information Security

Research Areas

Information Security and Trust

Publication

Journal of Computer Security

Volume

10

Issue

1/2

First Page

137

Last Page

157

ISSN

0926-227X

Publisher

IOS Press

Additional URL

http://dl.acm.org/citation.cfm?id=597917.597923