模糊异常度特权程序异常检测  

Anomaly Detection for Privileged Programs with Fuzzy Abnormal Membership

作　　者：彭新光[1] 贾宁[1] 王峥[1] 

机构地区：[1]太原理工大学计算机科学与技术系,太原030024

出　　处：《计算机工程与应用》2006年第36期124-126,共3页Computer Engineering and Applications

基　　金：山西省自然科学基金资助项目(20041047)

摘　　要：在形式化定义正常、异常和环境依赖系统调用短序列概念的基础上,以模糊理论为基础,采用模糊片段异常度刻画系统调用短序列的局部行为状态。通过对特权程序Sendmail在正常和各种攻击模式下的系统调用跟踪数据集进行实验,结果证明采用模糊概念抽象归属不明确的局部行为,明显地提高了特权程序异常检测模型的灵活性、适应性和对各种异常行为的识别能力。The local behavior statuses of the short sequence of system calls is depicted by the abnormal membership on fuzzy segments according to fuzzy＇theory,on the basis of formal definitions of normal,abnormal and context dependency short sequences of system calls.Experiments on the data set of system call traces of the privileged program Sendmail have been completed under the condition of normal and attack pattern.Resuhs indicate that the local behavior with uncertain property is abstracted by the fuzzy concept evidently to increase the flexibility,adaptability and distinguishing capability of anomaly detection model against known and unknown attacks.

关 键 词：异常检测 特权程序 系统调用 环境依赖 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]