Abstract:

In recent years, advanced persistent threat (APT) has become the chief threat to enterprise users.The traditional security protection methods, such as signature-based detection and perimeter protection, are insufficient in dealing with APT.Therefore, the status of network anomaly behavior detection method was described.The technology roadmap and system architecture of abnormal behavior detection based on statistical learning were introduced.The feature extract method and statistical modeling methods were proposed.The characteristic of abnormal behavior detection based on big data was concluded and the direction of future research was proposed.

Key words: big data, security analysis, abnormal behavior detection, statistical learning