Development of anomalous computer behavior detection method based on probabilistic automaton

Abstract

This work proposes anomalous computer system behavior detection method based on probabilistic automaton. Main components of the method are automaton structure generation model and its modification procedure. The distinctive feature of the method is the adaptation of the automaton structure generation procedure for detecting attack scenarios of the same type, by restructuring the automaton upon a match and by recalculating the probability of state changes. Proposed method allows to speed up the detection of anomalous computer behavior, as well as to detect anomalies in computer systems, scenario profiles of which only partially match the instances used to generate automaton structure. The obtained results allow us to conclude that the developed meth-od can be used in heuristic analyzers of anomaly detection systems.