基于系统调用和数据挖掘的程序行为异常检测  

Anomaly Detection of Program Behaviors Based on System Calls and Data Mining

作　　者：田新广[1] 邱志明[1] 李文法[2] 孙春来[2] 段洣毅[2] 

机构地区：[1]海军装备研究院博士后工作站,北京100073 [2]北京交通大学计算技术研究所

出　　处：《计算机工程》2008年第2期1-3,共3页Computer Engineering

基　　金：国家“973”计划基金资助项目(2004CB318109);国家“863”计划基金资助项目(863-307-7-5);国家242信息安全计划基金资助项目(2005C39)

摘　　要：异常检测是目前入侵检测研究的主要方向之一。该文提出一种新的程序行为异常检测方法,主要用于Linux或Unix平台上以系统调用为审计数据的入侵检测系统。该方法利用数据挖掘技术中的序列模式对特权程序的正常行为进行建模,根据系统调用序列的支持度和可信度在训练数据中提取正常模式。在检测阶段,通过序列模式匹配对被监测程序的行为异常程度进行分析,提供两种可选的判决方案。实验结果表明,该方法具有良好的检测性能。Anomaly detection acts as one of the important directions of research on intrusion detection. This paper presents a new method for anomaly detection of program behaviors, which is applicable to intrusion detection systems using system calls as audit data on Linux or Unix platform. The method uses sequence patterns in data mining technique to model the normal behavior of a privileged program, and extracts normal system call sequences according to their support and confidence in the training data. At the detection stage, system call sequences are matched to perform the comparison of the historic behaviors and current behaviors, and then two alternative schemes can be used to distinguish between normal and anomalous behaviors. The experimental results show that the method can achieve high detection performance.

关 键 词：入侵检测 异常检测 系统调用 数据挖掘 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]