基于系统调用的0day攻击路径检测系统  

System call based 0day attack path detecting system

作　　者：张兵[1] 宁多彪[1] 赵跃龙[2] 

机构地区：[1]成都东软学院计算机科学与技术系,四川成都611844 [2]华南理工大学信息与科学工程学院,广东广州510640

出　　处：《计算机工程与设计》2015年第5期1176-1180,共5页Computer Engineering and Design

基　　金：中国博士后基金项目(2012M511845);国际固态酿造工程技术研究中心基金项目(GCK201102)

摘　　要：针对当前网络环境中缺乏有效检测0day攻击路径的方法的问题,实现基于系统调用的0day攻击路径检测系统。根据定义的语法规则和系统调用轨迹构造网络系统对象关系图,从网络系统对象关系图中识别出可疑的入侵传播路径,利用漏洞特征集合和漏洞指示函数识别出0day攻击路径。实验结果表明,该系统能够准确检测网络中存在的0day攻击路径,有效降低了误报和漏报率。In view of the lack of effective methods to detect 0day attack path in current network,the system call based 0day at-tack path detecting system was presented.Firstly,the grammatical rules were defined in the system,and then the graph of ob-j ect relation of the network system was constructed according to the tracks of the system calls by taking use of the pre-defined rules.After that,the suspicious network intrusion propagation path from the object graph was found out.At last,the 0day at-tack path was identified according to the feature set and exploit loopholes in the indicator function.Experimental results show that the proposed 0day attack path detection system can accurately detect the presence of 0day attack path of the network,and effectively reduce the false positive rate and false negative rate.

关 键 词：0day漏洞 系统调用 攻击路径 入侵检测 网络安全 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]