Online Intrusion Behaviors: Sequences and Time Intervals

In this study we model the sequences and time intervals of online intrusion behaviors. To maintain network security, intrusion detection systems monitor network environments; however, most existing intrusion detection systems produce too many intrusion alerts, causing network managers to investigate many potential intrusions individually to determine their validity. To solve this problem, we combined a clustering analysis of the time intervals of online users' behaviors with a sequential pattern analysis to identify genuine intrusion behaviors. Knowledge of the patterns generated by intruder behaviors can help network managers maintain network security.