论文标题
处理采矿可以帮助基于异常的侵入检测吗？
Can process mining help in anomaly-based intrusion detection?
论文作者
论文摘要
在本文中，我们考虑了过程挖掘在网络流量理解，流量异常检测和入侵检测中的幼稚应用。我们将将数据包数据转换为事件日志的过程标准化。我们使用PROM和使用Disco的模糊矿工来挖掘多个过程模型，并分析用电感矿工和模糊矿工分析的过程模型。我们比较从不同大小的事件日志中提取的两种类型的过程模型。我们将过程模型与RFC TCP状态过渡图和Bishop等人的图进行对比。我们分析与进程挖掘相关的问题和挑战，并解释了为什么使用网络数据的幼稚过程挖掘无效。
In this paper, we consider the naive applications of process mining in network traffic comprehension, traffic anomaly detection, and intrusion detection. We standardise the procedure of transforming packet data into an event log. We mine multiple process models and analyse the process models mined with the inductive miner using ProM and the fuzzy miner using Disco. We compare the two types of process models extracted from event logs of differing sizes. We contrast the process models with the RFC TCP state transition diagram and the diagram by Bishop et al. We analyse the issues and challenges associated with process mining in intrusion detection and explain why naive process mining with network data is ineffective.
