一种基于控制流的程序行为扩展模型  

A Control Flow Based Program Behavior Extended Model

作　　者：陆炜[1] 曾庆凯[1] 

机构地区：[1]南京大学 计算机软件新技术国家重点实验室

出　　处：《软件学报》2007年第11期2841-2850,共10页Journal of Software

基　　金：Nos.60473053;60773170(国家自然科学基金);Nos.2004AA147070;2006AA01Z432(国家高技术研究发展计划(863));No.BK2005074(江苏省自然科学基金)~~

摘　　要：提出一种基于控制流的程序行为扩展模型EMPDA(extended model based on push down automaton).对控制流模型加入不变性约束扩展,该模型能够表达程序正常运行时所应保持的不变性质约束,增强了模型的监控能力;通过以实际应用区分系统调用重要性,将模型划分为核心模型和辅助模型,以降低模型整体消耗,提高模型学习效率.实验结果表明,该扩展模型较之原模型有更好的覆盖速度、误报率以及检测能力.This paper presents a control-flow-based program behavior extended model EMPDA （extended model based on push down automaton） by adding invariance constraints to control flow model, which can describe some invariance properties while a program is running safely, and enhance the ability of intrusion detection. By distinguishing the importance of system calls according to practical applications, this paper divides the program behavior model into core model and secondary model to reduce the workload of the model and improve the learning efficiency. Experimental results show that the extended model has better performances in many aspects, such as coverage speed, false positive rate and the capability of intrusion detection.

关 键 词：程序行为模型 异常检测 控制流 不变性约束 系统调用 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]