Abnormal Behavior Detection Technique Based on Big Data

Abstract

Nowadays, cyber-targeted attacks such as APT are rapidly growing as a social and national threat. As an intelligent cyber-attack, the cyber-targeted attack infiltrates the target organization or enterprise clandestinely using various methods and causes considerable damage by making a final attack after long-term and through preparations. Detecting these attacks requires collecting and analyzing data from various sources (network, host, security equipment) over the long haul. Therefore, this paper describes the system that responds to the cyber-targeted attack based on Big Data and a method of abnormal behavior detection among the cyber-targeted attack detection techniques provided by the proposed system. Specifically, the proposed system analyzes faster and precisely various logs and monitoring data that have been discarded using Big Data storage and processing technology; it also provides integrated security intelligence technology through data correlation analysis. In particular, abnormal behavior detection using MapReduce is effective in analyzing large-scale host behavior monitoring data.