Analysis and Evaluation for Detection Techniques on Host Anomalous Behavior Using Machine Learning

The detection of unknown attacks inside the host usually adopts the methods of constructing a normal behavior model, monitoring the internal state of the host and auditing the program activity log. With the increase of detection data, the detection efficiency and accuracy of traditional host abnormal behavior detection technologies will decline significantly. Machine learning based detection methods can effectively improve the detection efficiency and accuracy, and become an important direction of host abnormal behavior detection research. We introduce the basic situation and challenges of host based anomaly detection technology, summarizes the characteristics and application scenarios of three types of research dataset, including network, internal threat and malicious code, and focuses on analyzing the advantages and disadvantages of detection technology models based on traditional machine learning and deep learning in recent years To improve the robustness of the detection model and the evaluation index of the model performance, the feasibility suggestions for the next technological development are put forward.