基于系统调用的入侵检测系统设计与实现  

Design and implementation of intrusion detection system based on system-call

作　　者：张军[1] 苏璞睿[2] 冯登国[2] 

机构地区：[1]中国科学技术大学电子工程与信息科学系,安徽合肥230027 [2]中国科学院软件研究所,北京100049

出　　处：《计算机应用》2006年第9期2137-2139,2144,共4页journal of Computer Applications

基　　金：国家973规划资助项目(G1999035802);国家杰出青年基金项目(60025205)

摘　　要：介绍了一个基于系统调用的灵活加载的入侵检测系统。该系统改进了常用的数据采集方法,采用虚拟设备驱动来获取系统调用。这种数据采集方法对系统影响小,可以灵活装卸,并提供标准的接口。数据分析融合了异常检测和误用检测两种方法,提出了相应的检测模型,并引入了滤噪函数。The technology of Intrusion Detection is one of the important measures to protect the networks. Host-based intrusion detection is used to protect the key hosts. A flexible loading intrusion detection based on system-call was introduced in this paper. This system improved the common data collection method, and adopted virtual equipment driversto acquire system call. This method brings small influence on system, is easy to load and unload, and provides the standard interface. The data analysis integrates the two detection methods： anomaly and misuse, which provides corresponding detection models and introduces the noise filtering function.

关 键 词：入侵检测 系统调用 虚拟设备驱动 滤噪函数 非层次聚类 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]