基于数据挖掘和变长序列模式匹配的程序行为异常检测  

Anomaly Detection of Program Behaviors Based on Data Mining and Variable-Length Sequence Matching

作　　者：田新广[1] 李文法[1,2] 段洣毅[1,2] 孙春来[1] 邱志明[3] 

机构地区：[1]北京交通大学计算技术研究所 [2]中国科学院计算技术研究所,北京100080 [3]海军装备研究院博士后工作站

出　　处：《信号处理》2008年第4期551-555,共5页Journal of Signal Processing

基　　金：国家“九七三”重点基础研究发展规划项目(2004CB318109);国家“八六三”高技术研究发展计划项目(863-307-7-5);国家242信息安全计划项目(2005C39)

摘　　要：异常检测是目前入侵检测领域研究的热点内容。提出一种基于数据挖掘和变长序列模式匹配的程序行为异常检测方法,主要用于Unix或Linux平台上以系统调用为审计数据的主机型入侵检测系统。该方法利用数据挖掘技术中的序列模式对特权程序的正常行为进行建模,根据系统调用序列的支持度在训练数据中提取正常模式,并建立多种模式库来表示一个特权程序的行为轮廓。在检测阶段,考虑到审计数据和特权程序的特点,采用了变长序列模式匹配算法对程序历史行为和当前行为进行比较,并提供了两种判决方案,能够联合使用多个窗长度和判决门限对程序行为进行判决,提高了检测的准确率和灵活性。文中提出的方法已应用于实际入侵检测系统,并表现出良好的检测性能。Network anomaly detection has been an active research topic in the field of Intrusion Detection for many years. This paper presents a new method for anomaly detection of program behaviors based on data mining and variable-length sequence pattern matching. The method uses sequence patterns in data mining technique to model the normal behavior of a privileged program, extracts normal system call sequences according to their supports in the training data, and constructs multiple dictionaries of sequences of different lengths to represent the behavior profile of the program. At the detection stage, variable length sequences are matched to perform the comparison of the historic normal behaviors and current behaviors, and two different schemes can be used to determine whether the monitored program＇ s behaviors are normal or anomalous while the particularity of program behaviors and audit data is taken into account. The application of the method in practical intrusion detection systems shows that it can achieve high detection performance.

关 键 词：入侵检测 数据挖掘 异常检测 系统调用 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] F270.7[自动化与计算机技术—计算机科学与技术]