一种进程系统调用重复子序列的压缩算法  

A Method of Compressing Repeated Segments in System Call Sequences Executed by the Process

作　　者：黄梅荪[1] 杨寿保[1] 张蕾[1] 李宏伟[1] 

机构地区：[1]中国科学技术大学计算机科学技术系,合肥230026

出　　处：《计算机科学》2004年第7期91-93,共3页Computer Science

基　　金：国家自然科学基金(编号90104030);安徽省"十五"科技攻关项目(编号01012013)支持

摘　　要：以往入侵检测系统中采用的进程检测方法并未对进程系统调用序列中产生的重复子序列进行处理。本文提出了一种进程系统调用重复子序列的压缩算法,在系统调用序列收集过程中找出重复子序列,再将其作为一个整体参与模式的提取与检测。测试表明,对系统调用序列中的重复子序列进行压缩后能有效减少系统调用序列的长度,从而简化模式的学习和检测,提高进程检测的效率。The intrusion detection methods based on process don't pay enough attention to short repeated sequences of system calls executed by running processes. This paper presents a method of compressing repeated segments in sys- tem call sequences run by the process. When collecting the system calls ,we mark the repeated sequences,which are treated as a whole to the process of pattern extraction. The data of experiment show that the length of the system call sequence is reduced after compressing the repeated sequences, to simplify the procedure of pattern study and detection and increase the efficiency.

关 键 词：入侵检测 系统调用 变长模式 进程检测 压缩算法 子序列 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]