Linux进程语义安全性检测的稳定模型

Stable Model of Semantics_based Security Detection for Linux Process

现有进程检测方法,检测的目标是系统调用的序列的排列关联,忽略了语义中潜在的异常。稳定模型是逻辑程序的语义模型,可以用以发现并修改逻辑程序的异常问题。该文以系统调用为基本检测点,采用逻辑程序描述进程的基本语义逻辑,用稳定模型表达进程的检测语义。系统定义进程的一系列安全语义规则,在进程执行中,计算安全语义规则与进程逻辑之间的稳定模型,得到安全语义的可计算性结论。论文最后,给出了一个Linux系统中的进程语义安全性检测的基本框架。

At present,identifying patterns from system call trails are the primary method of process detection,and it neglects latent anomaly in semantics.As the semantics model of logic program,stable model can be used to find and modify the anomaly of logic program.This paper indicates the basic semantics logic of the process with logic program by detecting the system call.Then,the paper introduces a method to define the security semantics rules of the process,and get the conclusion of security semantics through calculating the stable model of security semantics rules and the process logic.At the end,a basic frame for semantics_based security detection based on Linux process is introduced in this paper.