一种基于系统调用异常检测的改进算法

An Improved Method Based on System Call Anomaly Detection

基于系统调用的异常检测方法只能检测到攻击的发生,不能判断出攻击的性质和目的。针对这个问题,提出了一种算法(对系统调用序列和传统算法检测到的攻击进行再分析),基本思路是在训练时统计系统调用的频率信息,建立程序正常运行时的文件访问分布模型,并在系统调用的层次上提出一种攻击的分类方法,在检测时以传统的基于系统调用的异常检测方法为基础,结合训练时得到的信息,确定攻击所属的类别和攻击的优先级。实验结果表明,该方法能有效预测出攻击的性质和目的,并改善了原方法的检测率和误报率等指标。

System call based anomaly detection can not predict the intent of attacks, to solve this problem, a further analysis method was proposed, which conducted further analysis on system call sequence and the detection results of traditional method. The basic idea is to record system call frequency information,construct file access distribution models of properly running programs at train phase, at detection phase, traditional methods were modified to take these information and models into account to determine the classes of attacks. Experiments show that our method can effectively predict attack＇ s intent, while its detection rate and false positive performance is comparable to or better than the other approaches.