Research on Immune Storage Anomaly Detection Via User Access Behavior

Huang Jianzhong,Chen Yunliang,Fang Yunfu
DOI: https://doi.org/10.1117/12.821631
2008-01-01
Abstract:If an intruder uses a stolen account, the authentication sub-system will regard the intruder as a legitimate user. In order to filter out such illegal users, the storage system should be capable of user activity diagnosis. This paper presents a novel anomaly detection scheme to monitor the user access activities using the artificial immune technique. When an access request violates the access control rule, it is regarded as Non-self, so as to provide some early warning tips to the storage security sub-system. Compared with the NIDS, the proposed scheme targets the anomaly detection at storage level and focuses on the read/write data requests. Before simulation, a set of appropriate parameters of algorithm are fitted according to the mean convergence speed and detection efficiency. The simulation shows the proposed scheme can reach rather high detection rate and low false alarm rate, further validating its feasibility.
What problem does this paper attempt to address?