一种进程系统调用重复子序列的压缩算法

A Method of Compressing Repeated Segments in System Call Sequences Executed by the Process

以往入侵检测系统中采用的进程检测方法并未对进程系统调用序列中产生的重复子序列进行处理。本文提出了一种进程系统调用重复子序列的压缩算法,在系统调用序列收集过程中找出重复子序列,再将其作为一个整体参与模式的提取与检测。测试表明,对系统调用序列中的重复子序列进行压缩后能有效减少系统调用序列的长度,从而简化模式的学习和检测,提高进程检测的效率。

The intrusion detection methods based on process don't pay enough attention to short repeated sequences of system calls executed by running processes. This paper presents a method of compressing repeated segments in sys- tem call sequences run by the process. When collecting the system calls ,we mark the repeated sequences,which are treated as a whole to the process of pattern extraction. The data of experiment show that the length of the system call sequence is reduced after compressing the repeated sequences, to simplify the procedure of pattern study and detection and increase the efficiency.