HMM-Based Detection Method for Resource Misuse in Information Systems
Dong Xu · Dianzi xuebao · 2010
The existing methods for resource misuse detection of information systems are restricted because of their own limitations,such as unable to detect new kinds of resource misuse and need the knowledge of potential misuses.A hidden Markov model(HMM) based method is presented to detect the resource misuse in information systems.In the HMM model,the file folders containing sensitive information are taken as the model states and the user operations as the model observation symbols.Baum-Welch algorithm is adopted to determine the model parameters.The behavioristic profiles of the insiders are determined by the HMM model and used to detect malicious behaviors.The simulation results show the effectiveness and adaptability of our method.