摘要
系统调用是操作系统和用户程序的接口 ,任何程序都必须通过系统调用才能执行 ,针对系统调用进行入侵检测的实施 ,能增加入侵检测的准确性和正确性 ,并使实时监测和分层安全成为可能。本文分析了在系统调用层面上实现入侵检测的可能性和优越性 ,详细阐明了目前各种基于系统调用入侵检测的方法和性能比较 ,讨论了基于系统调用入侵检测研究的发展趋势。
System calls are the interface between operating system and user programs Execution of each program must use some system calls So the implementation of intrusion detection using system calls will improve the accuracy and correctness It also makes realtime monitoring and layeredsecurity possible This paper first analyses the possibility and advantages of system call based on intrusion detection Then it describes some kinds of system call based on intrusion detection techniques in detail and compares performances of some methods Finally, the future direction in this field is discussed
出处
《现代电子技术》
2005年第4期36-39,共4页
Modern Electronics Technique
关键词
入侵检测
系统调用
特权进程
分层安全
intrusion detection
system call
privileged process
layered-security
