采用规划识别理论预测系统调用序列中的入侵企图

Plan Recognition Based Method for Predicting Intrusion Intentions of System Call Sequences

规划识别是一种根据观察数据识别和推断被观察对象目的或意图的预测理论 .在计算机系统入侵检测研究中 ,为了提前预测出异常事件的发生 ,提出了一种基于规划识别理论的入侵企图预测方法 .通过对主机上的系统调用序列为观察对象建立预测模型 ,提出了一种带参数补偿的贝叶斯网络动态更新算法 ,对观察对象的目的进行预测 .实验结果表明动态贝叶斯网络对预测系统调用序列中的异常入侵企图有较高的精度 .

Plan recognition is a prediction theory for identifying and determining the intentions or the attempts of the agents monitored through observation data. In this paper, a plan recognition based method is presented to predict the anomaly events and intensions of potential intruders to a computer system using the system call sequences as observation data. The method is established on a dynamic Bayesian network with parameter compensation and an algorithm is developed to update this network. The experimental results show that this method has a good accuracy in predicting the intrusion intensions from the system call sequences.