基于系统调用的主机异常检测研究综述  

Survey of Host Anomaly Detection Based on System Call

作　　者：樊燚 郭义伟 胡涛[1] 伊鹏[1] FAN Yi;GUO Yiwei;HU Tao;YI Peng(Information Engineering University,Zhengzhou 450001,China;Henan IEUCD Technology Co.Ltd,Zhengzhou 450001,China)

机构地区：[1]信息工程大学,河南郑州450001 [2]河南信大网御科技有限公司,河南郑州450001

出　　处：《信息工程大学学报》2024年第1期100-109,共10页Journal of Information Engineering University

基　　金：国家自然科学基金面上项目(62176264)。

摘　　要：系统调用记录了进程活动过程中最精确原始的行为信号,通过对应用程序与操作系统交互产生的系统调用进行分析,可以对进程的异常行为进行有效鉴别,保障主机的安全运行。对基于系统调用的主机异常检测的研究现状进行了梳理。首先介绍了异常检测常用数据集,其次总结了系统调用数据预处理的典型方法,然后详细分析和对比了系统调用异常检测常用算法和模型,并介绍了异常检测常用的评估指标,最后对未来研究方向及相关挑战进行了展望。System call records the most accurate and original behavior signals in process activities.By analyzing the system call generated by the interaction between the application program and the operating system,the abnormal behavior of the process can be effectively identified to ensure the safe operation of the host.The development status of host anomaly detection based on system call is reviewed.This paper introduces the common datasets of anomaly detection,summarizes the typical methods of system call data preprocessing,analyzes and compares the common algorithms and models of system call anomaly detection in detail,and introduces the common evaluation indicators of anomaly detection.Finally,the future possible research direction and related challenges are prospected.

关 键 词：主机异常检测 系统调用 深度学习 机器学习 网络安全 

分 类 号：TP301[自动化与计算机技术—计算机系统结构]