| With the rapid development of Internet information technology, the number and type of the network virtual property have increased rapidly. While bringing great convenience to people’s life, network virtual property also face security issues and it has become increasingly prominent nowadays, especially in field of virtual property transactions in e-commerce and online games. Since there are kinds of network virtual property, each with different operations, their behaviors changed dynamically and etc., how to effectively detect anomaly operation on the virtual property has become an urgent problem to be solved.This article is based on the national 863 key project “virtual property preservation system and application”. The research focused on a series of measures for virtual property data unified storage and management in order to maintain the integrity of the virtual property and prevent loss. Based on the project, in this paper, research on how to effectively detect the abnormal behaviors in virtual property operations has been carried out, including a virtual property data integration method and a virtual property operation anomaly detection method base on behavior analysis. By analyzing the characteristics of virtual property platforms and user’s behavior data, an abnormal behavior detection method based on data mining and recursive matching is proposed and experiments are carried out to verify the effectiveness of the algorithm. Finally, a virtual property abnormal detection module is designed and implemented. Main work of this paper is as follows:1. A virtual property data integration method was designed. According to the characteristics of virtual property data, a virtual property description language based on XML technology was designed and implemented. Taken the differences of virtual property data formats and types on different virtual property platforms into consideration, a unified virtual property data storage format and a virtual property data exchange framework were designed. Based on the data storage format and data exchange framework, two China telecommunications industry standards were in the application process.2. An abnormal behavior detection method based on data mining and recursive matching was proposed. Based on the virtual property data integration, we analyzed the user’s behaviors from two levels, including behavioral attributes associations and the operating modes of sequences. Then, we get user’s normal behavior pattern library, including the association rules which reflect the relationship among user’s behavioral attributes and the operating modes which reflect the users’ operation characteristics. By using an axis attribute matching method and a recursion correlation function, we calculated the similarity of the association rules and the operating modes respectively to get the credible factor AF of behavioral attributes layer and OF of operating sequences layer. Finally through the synthesis of AF and OF, we determined whether user’s behavior is abnormal. Relevant results were published in the 29 th National Computer Security Symposium.3. A virtual property anomaly detection module was designed and implemented. The function of the module includes data acquisition, data preprocessing, abnormal behavior detection and abnormal alarm. The feature and the relationship of each sub-module were analyzed in detail. Finally, the anomaly detection module was integrated into the virtual property preservation system. The operation test shows that the module is stable and reliable. It has provided solid foundation for other function modules within the system. |
