基于D-S证据理论的主机违规行为检查方法  

HOST VIOLATION CHECK METHOD BASED ON D-S EVIDENCE THEORY

作　　者：王斌[1,2,3] 连一峰[1,3] 陈恺[1,3] 

机构地区：[1]中国科学院软件研究所信息安全国家重点实验室,北京100190 [2]信息网络安全公安部重点实验室(公安部第三研究所),上海201204 [3]信息安全共性技术国家工程研究中心,北京100190

出　　处：《计算机应用与软件》2012年第2期90-93,148,共5页Computer Applications and Software

基　　金：信息网络安全公安部重点实验室(公安部第三研究所)开放基金资助课题(C10606)

摘　　要：主机违规行为是能对主机及其所在信息系统的安全造成影响,或泄露主机上的重要信息的行为。提出一种主机违规检查方法,针对主机违规行为证据信息进行单一证据源基础概率判定,并通过D-S证据理论对其进行融合,计算得到主机行为的违规系数,以此作为违规检查的判定依据。实验表明,该方法能够满足主机违规检查工作的应用需求,具有较低的误报率和漏检率。Host violation is a such behaviour that it either breaks the security of the host and its information system or reveals the important information on the host.In this paper,a host violation checking method is proposed,which discriminates the underlying probability of single evidence resource aiming at the evidence information of each violation of host independently,and then fuses them based on D-S evidence theory,and attains violation coefficient of the host behaviour according to calculation,that will be considered as the discrimination basis for violation checking.Experiments indicate that by using this method,the application demand in host violation checking is able to be met with lower false alarm rate and missing rate.

关 键 词：D-S证据理论 主机违规行为 异常检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]