一种面向生产系统的控制流异常检测算法  

Production system oriented control flow anomaly detection algorithm

作　　者：王禹同 常朝稳[1] 樊子华[1] 韩培胜[1] 

机构地区：[1]信息工程大学,郑州450001

出　　处：《计算机应用研究》2017年第5期1509-1514,共6页Application Research of Computers

基　　金：国家"863"计划资助项目(2012AA012704);国家"973"计划资助项目(2011CB311801)

摘　　要：针对生产系统的入侵攻击行为朝着规模化、分布化、复杂化等方向演变,传统的基于漏洞库、病毒库、规则匹配等被动式防护手段难以应付隐藏在生产系统内部的攻击行为。从生产系统的业务程序控制流出发,提出了一种基于路径匹配的生产系统控制流异常检测算法CFCPM。提出了一种基于关键路径匹配的基本组划分方法,通过扩大控制流分析的基本研究单元,降低了断言标签式控制流分析方法对系统运行造成的性能负担。分别介绍了CFCPM算法的标准路径集获取阶段和路径匹配阶段,通过判断当前控制流路径是否偏离标准路径集,察觉生产系统所处的异常工作状态。通过异常检测能力分析与实验验证证明了该算法对业务程序控制流异常检测的有效性。With the rapid development of computer systems,intrusion attack methods have become large-scale,distributed and complex. Traditional protection means such as vulnerability database,virus database and rule matching can not cope with the attacks hidden inside the terminals. This paper proposed a production system oriented control flow anomaly detection algorithm CFCPM from the control flow of the business programs. Firstly it proposed a basic group partition mehod based on key paths to reduce the performance burden caused by tabbed-assert control flow analysis method through expanding basic research units.Then it introduced the algorithm phases of standard path set acquisition and path matching. By judging whether the current control flow path deviating from the standard set,the abnormal operating conditions of production systems could be detected. Finally,it demonstrates the effectiveness of CFCPM by anomaly detection ability analysis and experiments.

关 键 词：生产系统 控制流 异常检测 路径匹配 

分 类 号：TP277[自动化与计算机技术—检测技术与自动化装置]