GECISM中沙盒主机的“非我”检测与分类  

Detection and Classification of "Non-self" in Sand Box of GECISM

作　　者：李珍[1] 王凤先[1] 余晓雅[2] 

机构地区：[1]河北大学数学与计算机学院,河北保定071002 [2]河北大学机械与建筑工程学院,河北保定071002

出　　处：《计算机工程与应用》2005年第35期129-131,182,共4页Computer Engineering and Applications

基　　金：河北大学校内课题项目(编号:2003Z06)

摘　　要：对仿生免疫系统GECISM(General Computer Immune System Model),沙盒主机是其中的一个主要代理。文章详细介绍了沙盒主机中“非我”检测与分类的结构。通过定义安全相关调用,对采集形成的安全相关调用短序列进行训练,生成序列库和规则库,从而对“非我”进行检测和分类,同时对测试程序“非我”类型的分布进行了讨论。实验证明了用此方法进行“非我”检测和分类的可行性和高效性。Sand box is a main component of agents in GECISM.The structure of detection and classification of ＂non-self＂ in sand box is introduced in detail.The concept of system call related to security is defined, and sequence library and rule library are built by training short sequences of system call related to security.Then ＂non-self＂ can be detected and classified,and the distributing of different types of ＂non-self＂ in testing program is discussed.The experiment verifies the feasibility and effectiveness of this method.

关 键 词：计算机免疫系统 系统调用序列 “非我”检测 分类 分布 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]