一种改进的基于系统调用的入侵检测技术  

New Intrusion Detection Thehnology Based on System Calls

作　　者：李千目[1] 戚勇[1] 刘凤玉[1] 

机构地区：[1]南京理工大学计算机科学与技术系,江苏南京210094

出　　处：《小型微型计算机系统》2004年第7期1348-1351,共4页Journal of Chinese Computer Systems

基　　金：国家自然科学基金资助项目 (69973 0 2 0 )资助 ;国防科工委应用基础基金资助项目(J13 0 0 D0 0 4)资助

摘　　要：随着恶意入侵计算机现象的日益严重 ,准确检测入侵的需求应运而生 .本文提出一种基于系统调用的入侵检测方法—— SGNN算法 .该算法解决了传统基于系统调用入侵检测方法的缺陷 ,不仅去除了降低检测效率的规则 ,同时能有效识别用户的误操作 .As malicious intrusions into computer system have become a growing problem, the need for accurately detecting these intrusions has risen. This paper proposed a novel approach to detecting intrusions by using system call method. The problems of old intrusion detection technology based on systems calls have been solved by SGNN algorithm. The rules that have affected the efficiency of intrusion detection will be deleted. Simultaneity, SGNN is good for recognizing the mistakes of users. The experiments show that the proposed method is practical and efficient.

关 键 词：入侵检测 系统调用 异常检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]