摘要
针对Windows操作系统受到的越来越多的严重攻击,提出一种基于Native API序列的多步一致模型和指数迭代检测算法,实现了从内核空间检测Windows操作系统中的异常入侵.通过设计内核虚拟设备来截获系统服务分配表,从而可实时地获取Native API信息.用被截获的正常Native API数据建立一步和二步一致模型,并以此描述进程的正常行为.在检测过程中,通过指数迭代检测算法,可对不断出现的Native API的正常指数进行度量.采用报警提取算法对正常指数进行分析可惟一地确定对应的攻击,为管理员及时掌握系统的安全状况提供了保证.在不同的Windows操作系统环境下的实验结果表明,该方法有较好的检测精度.
In order to detect more and more serious attacks against the Windows operating system (OS), a multi-step consistency model and exponential iteration detection algorithm (EIDA) based on Native API sequences were proposed to realize the detection of the anomaly intrusions from kernel space in Windows operating system. The system service dispatch table is captured by designing a virtual device so as to get the Native API information in real time. One step and two steps consistency models are built by the captured normal Native API data to describe the normal behavior of processes. In the detection process, the normal index of emerging Native API is measured continuously by EIDA. The normal indexes are analyzed through an alarm extraction algorithm, which uniquely determines the corresponding attack and provide administrator with guarantee to grasp the security situation of OS in time. The experiments under different Windows OS environment indicate that the proposed method has better accuracy.
出处
《西安交通大学学报》
EI
CAS
CSCD
北大核心
2006年第4期406-410,共5页
Journal of Xi'an Jiaotong University
基金
国家杰出青年基金资助项目(60243001)
国家自然科学基金资助项目(60243001)
国家高技术研究发展计划资助项目(2001AA140213)
关键词
异常检测
操作系统
多步一致模型
指数迭代检测算法
anomaly detection
operating system
multi-step consistency model
exponential iteration detection algorithm