基于双空间审计迹的Linux安全审计技术  

Linux Security Audit Technology Based on Double Spaces Audit Trace

作　　者：段雪涛[1] 贾春福[1] 

机构地区：[1]南开大学信息技术科学学院,天津300071

出　　处：《计算机工程》2009年第18期130-132,共3页Computer Engineering

基　　金：天津市自然科学基金资助项目(033800611)

摘　　要：在研究Linux安全审计技术的基础上,提出一种基于双空间审计迹的安全审计方法,融合操作系统内核空间的系统调用和用户空间的库函数调用,提高对操作系统内核层攻击和恶意用户行为的识别能力。对LSM框架进行审计扩展,用于设计审计模型的数据获取模块,增强了模型的审计粒度、安全性和灵活性。为了提高安全审计的实时性,引入典型集方法压缩正常行为特征库。This paper researches Linux security audit technology and proposes a security audit method based on double spaces security audit. The operating system kernel space system call and user space library function call are merged to enhance the identified ability against the operating system kernel attacks and user＇s malicious behaviors, an extended LSM（Linux Security Modules） framework is designed for audit data hook module to improve the audit granularity, security and flexibility of security audit model. In order to improve the real-time efficiency, a typical set method is introduced to compress the normal signature database.

关 键 词：安全审计 系统调用 典型集 

分 类 号：TP316[自动化与计算机技术—计算机软件与理论]