Security and Communication Networks

Research Article

Task-Oriented Network Abnormal Behavior Detection Method

Actions of downloading a single file.


Type	Action identification

Human-computer interaction Action identifications	Input user's information: a_{1_1}: Input_login
	Input file path: a_{1_2}: Input_fPath
	Click connect button: a_{2_1}: click_connect_button
	Click download button: a_{2_2}: click_download_button
	Click close button: a_{2_3}: click_close_button
	Double-click to start application: a_{2_4}: double_click
	Initialization socket_fd: a₃: socket_init

Basic function Action identifications	Create a socket connection: a₄: socket_create_connect_[PORT]
	Initiate a control connection: a₅: ftp_connect_21
	Send cmd command: a₆: ftp_sendcmd_[CMD]
	Download a single file: a₇: ftp_retrbinary

Cache Action identifications	Send data to cache: a₈: send_[SIZE]_[ADDR]
	Read data from cache: a₉: recv_[SIZE]_[ADDR]

State jump Action identifications	Socket connection successful: a₁₀: connect_success_[PORT]
	Close socket connection: a₁₁: socket_close_[ADDR]
	Log in successfully: a₁₂: login_success
	Close the application: a₁₃: ftp_close