基于系统调用行为相似性聚类的主机入侵检测方法研究  

Research on Host Intrusion Fetection Method Based on System Call Behavior Similarity Clustering

作　　者：李橙 罗森林[1] Li Cheng;Luo Senlin(Information System and Security&Countermeasures Experimental Center,Beijing Institute of Technology,Beijing 100081)

机构地区：[1]北京理工大学信息系统及安全对抗实验中心,北京100081

出　　处：《信息安全研究》2021年第9期828-835,共8页Journal of Information Security Research

基　　金：国家242信息安全计划项目(2019A021);工信部2020年信息安全软件项目(CEIEC-2020-ZM02-0134)。

摘　　要：基于内核模块抽象的主机入侵检测方法中,同一内核模块的部分系统调用存在较大行为差异,且不同内核模块也含有行为相似的系统调用,造成行为抽象映射的混淆,影响检测效果.提出了一种基于系统调用行为相似性聚类的主机入侵检测方法,首先利用Word2Vec构建连续稠密词向量实现多维度系统调用行为语义相似性信息提取,再使用聚类算法对系统调用进行抽象表征,减小行为抽象映射的混淆.基于ADFA-LD和ADFA-WD数据集的实验结果表明,该方法能够有效降低行为抽象表征的混淆,提升检测效果.同时,可通过选取聚类簇数较大幅度提高检测时间效率,实用价值大.In the host intrusion detection method based on kernel module abstraction,some system calls of the same kernel module have different behaviors,and different kernel modules also contain system calls with similar behaviors,which cause confusion of abstract mapping of behavior and affect the detection performance.This paper proposes a host intrusion detection method based on system call behavior similarity clustering.Firstly,Word2 Vec is utilized to construct continuous dense word vector to extract multi-dimensional semantic similarity information of system call behavior.Then the clustering algorithm is utilized to make abstract represent of system call which reduces the confusion of behavior abstract mapping.The result of the experiment based on ADFALD and ADFA-WD datasets show that the method can effectively reduce the confusion of abstract mapping of behavior and improve the detection performance.At the same time,the efficiency of detection can be greatly improved by selecting different number of clusters,which has great practical value.

关 键 词：行为相似性 Word2Vec 聚类 系统调用 主机入侵检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]