基于多层抽象的程序行为模型及异常检测研究  

Research on Program Behavior Model and Anomaly Detection Based on Multiple Abstraction

作　　者：程霞[1,2] 王晓锋[3] 

机构地区：[1]四川师范大学经济与管理学院,成都610068 [2]南开大学商学院,天津300071 [3]华为赛门铁克科技有限公司,北京100085

出　　处：《计算机科学》2010年第3期86-90,143,共6页Computer Science

基　　金：国家自然科学基金(70471040);国防研究基金(4131605)资助

摘　　要：在入侵检测领域,对程序行为的异常分析始终缺乏高效的短周期模型,现有模型对程序行为的抽象能力非常有限。为此,首先提出一种新的、具备充分自描述能力的模式:间隙变长频繁短序列模式(GV模式),该模式涵盖描述程序行为的顺序、选择和循环3种基本结构;然后给出GV模式挖掘算法以及基于GV模式库的系统调用流程图模型。实验表明,基于新模型的异常检测算法简单高效,在保持高检测率的前提下具有较低的检测开销和误检率,具备了实时检测能力。Efficient short sequence models used in anomaly analysis of program behaviors are not available in anomaly detection field. The current models are short of abstracting program behaviors. Therefore, a new highly self-explanatory pattern called GV pattern（gapped variable frequent pattern） was provided to cover three fundamental structures of program： sequence,selection and circulation. Subsequently, GV pattern mined algorithm and system-call flow chart model based on GV pattern library were presented in details. Experiments show that the anomaly detection algorithm based on new model keeps low detection overhead and false positive rate on the condition of high detection rate, which is crucial in a real-time intrusion detection system.

关 键 词：异常检测 短周期模型 行为分析 模式匹配 数据挖掘 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]