Unsupervised Behavior Evaluation Method in Trustworthy Network

Abstract

Behavior evaluation is an important research topic in trustworthy network. Up to now, most effect focuses on the validity of host's and user's identity, such as integrity measurement and access control, which could not guarantee the trustworthiness of valid user's behavior. In this paper, we proposed an unsupervised method for evaluating user's network behavior and trustworthiness grades in a local network. Firstly, we collected network behavior samples as more as possible. The occasions for sampling network behavior should be distinctly various in order to guarantee the collection of samples contains all possible behavior modes in network. Secondly, after initially preprocessed, the sample data was tagged with different trustworthiness grades. Lastly, according to the graded sample data, our method constructed a support vector machine to evaluate user's latter network behavior. We applied this method to a corporation network which contained many employee terminals. The result of behavior evaluation showed that this method is reasonable and feasible.