综合控制流与数据流分析的主机异常检测新方法  

NEW HOST ANOMALY DETECTION METHOD COMBINING ANALYSES OF CONTROL FLOW AND DATA FLOW

作　　者：吴敏[1] 唐德鹏 

机构地区：[1]东华大学计算机科学与技术学院,上海201620

出　　处：《计算机应用与软件》2015年第5期33-37,45,共6页Computer Applications and Software

摘　　要：传统主机异常检测方法只针对控制流信息或数据流信息进行分析,在两个研究方向上产生了很大的分化,不能很好地吸取彼此的成果。基于这种情况,提出一种新的综合控制流与数据流分析的新方法。该方法首先使用系统调用定长序列构建模式库,再用关联规则挖掘方法挖掘同一模式或不同模式下属性间的关联规则,构建用于检测评估的两种规则集。实验结果表明,基于控制流上下文的数据流分析新方法能够发现先前数据流分析所不能发现的更精准更有用的规则从而检测出更多的异常行为。Traditional host anomaly detection method only analyses either control flow information or data flow information. There is a big gap between the two research directions, this leads to them not making good use of each other＇s achievements. Based on this, we put forward a new method which combines control flow analysis and data flow analysis. The method first uses the fixed length sequence of system call to build patterns library, then with the help of association rule mining technique it minds the association rule of same pattern or the rules between the properties of different patterns, and builds two rule sets for detection and evaluation. Experimental results show that the new method of control flow context-based data flow analysis is able to find some more accurate and useful rules that cannot be found in previous data flow analysis, so that more abnormal behaviours can be detected.

关 键 词：系统调用 数据流 控制流 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]