基于系统调用序列的动态截获和实时仲裁模型  

An Anomaly Arbitration Model Based on Bayes' Rule

作　　者：全代勇[1] 栾国森[1] 

机构地区：[1]三峡大学电气信息学院,湖北宜昌430002

出　　处：《科技信息》2007年第31期102-102,15,共2页Science & Technology Information

摘　　要：提出了一种基于系统调用序列的仲裁模型,该模型动态截获程序的系统调用序列,将截获的系统调用序列送到仲裁机构。仲裁机构按照事先制定的策略,利用贝叶斯概率模型仲裁该系统调用序列的置信度,依据置信度高低决定拒绝执行还是安全放行。从而,达到主动防御目的。More and more malicious software exploit the vulnerabilities of system and applications to ruin the system .An anomaly arbitration model analyzing processes＇s behaviors is introduced.The system call sequences dynamically intercepted are transmitted into arbitration unit,where the system call will be decided to be continue or to be rejected according to the strategies.The The judge rules are come into being based on Bayes＇s Law.

关 键 词：系统调用序列 动态截获 仲裁模型 贝叶斯定理 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]