摘要
At present, insider threat detection requires a series of complex projects, and has certain limitations in practical applications; in order to reduce the complexity of the model, most studies ignore the timing of user behavior and fail to identify internal attacks that last for a period of time. In addition, companies usually categorize the behavior data generated by all users and store them in different databases. How to collaboratively process large-scale heterogeneous log files and extract characteristic data that accurately reflects user behavior is a difficult point in current research. In order to optimize the parameter selection of the DBSCAN algorithm, this paper proposes a Psychometric Data & Attack Threat Density Based Spatial Clustering of Applications with Noise algorithm (PD&AT-DBSCAN). This algorithm can improve the accuracy of clustering results. The simulation results show that this algorithm is better than the traditional DBSCAN algorithm in terms of Rand index and normalized mutual information.
延伸閱讀
- Yang, C. P. (2016). A Data Clustering Algorithm Based on Multiple Pairwise Similarity Matrices [master's thesis, National Taiwan University]. Airiti Library. https://doi.org/10.6342/NTU201602897
- Feng, Y., Kang, Y., Zhao, Y., & Zhang, W. (2019). A DD-means Clustering Algorithm for Intrusion Behavior Analysis. 電腦學刊, 30(3), 224-230. https://doi.org/10.3966/199115992019063003017
- Mei, L., & Zhang, F. (2020). A Distributed Density-based Outlier Detection Algorithm on Big Data. International Journal of Network Security, 22(5), 775-781. https://doi.org/10.6633/IJNS.202009_22(5).07
- Yang, J., Xiao, Y., Wang, J., Ma, Q., & Shen, Y. (2015). A Fast Clustering Algorithm for Data with a Few Labeled Instances. Computational Intelligence and Neuroscience, 2015(), 181-190. https://doi.org/10.1155/2015/196098
- KHAN, M. W., ASIF, H. M. S., & SALEEM, Y. (2017). Semantic Based Cluster Content Discovery in Description First Clustering Algorithm. Mehran University Research Journal of Engineering and Technology, 36(1), 1-6. https://www.airitilibrary.com/Article/Detail?DocID=P20170126001-201701-201701260036-201701260036-1-6