基于HMM的系统调用序列异常入侵检测  

An Intrusion Detection of Anomalous Based on HMM System Call Sequence

作　　者：王志刚[1] 钱兴坤[1] 王东亮[1] 

机构地区：[1]中国石油大学(华东)计算机与通信工程学院,山东257061

出　　处：《网络安全技术与应用》2006年第7期20-22,共3页Network Security Technology & Application

摘　　要：本文首先介绍了入侵检测的发展状况,接着用马尔可夫和BW算法进行建模;然后以系统调用执行迹这类常用的入侵检测数据为例,验证该模型的工作效果,最后将计算机仿真结果与其他检测方法进行了比较。通过实验和比较发现,基于HMM的系统调用序列的异常检测率比其他方法有明显的提高。First,the research progress of intrusion detection is recalled,then the model of an IDS Dased on Markov and BW is presented.An example of using system call trace data,which is usually used in intrusion detection,is given to illustrate the performance of this model.Finally,comparison of detection ability between the above detection method and others is given.It is found that the IDS based on HMM System Call squence has improve the accuracy greatly.

关 键 词：入侵检测 HMM BW 系统调用 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP309[自动化与计算机技术—计算机科学与技术]