基于变长系统调用序列模式的入侵检测方法研究  

Intrusion Detection Using Variable-length System Call Pattern

作　　者：李永忠[1] 徐静[1] 赵博[1] 杨鸽[1] 

机构地区：[1]江苏科技大学电子信息学院,江苏镇江212003

出　　处：《江苏科技大学学报（自然科学版）》2007年第3期36-41,共6页Journal of Jiangsu University of Science and Technology:Natural Science Edition

基　　金：江苏省教育厅;江苏科技大学资助课题(2005DX006J)

摘　　要：提出了一种变长序列模式的寻找算法,从训练序列中找出一组基本相对独立的变长序列模式,并在模式集的更新过程中自动定义了模式间的前后次序关系,以此构建了一个描述进程执行模式的DFA。针对已有基于变长序列模式的模式匹配算法需要向前预测若干个系统调用号的缺点,设计了一个更好的模式匹配算法。实验结果表明,算法在模式寻找过程中是稳定的,并在保持小规模模式集的情况下,取得了很低的误报率和漏报率。A new algorithm for the variable-length pattern from system call sequences is proposed. It is the way to present a novel simple technique to build a table of variable-length patterns from the training system call sequences , so as to find out a set of basic and relatively independent variable - length patterns. With this me - thod, all the possible relationships between the variable-length tation of the program is constructed, and an evaluation scheme patterns are found out. An exact DFA represen- is proposed for the variable-length patterns. The experimental results indicate that this algorithm can generate a relative small set of patterns, and obtain very low false positives and false negatives.

关 键 词：入侵检测 系统调用 模式匹配 变长序列模式 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]