基于系统调用顺序和频度特性的入侵检测模型

A New Intrusion Detection Model Based on Combination of Order and Frequency Characters of System Calls

提出了一种将系统调用的顺序特性和频度特性相接合来构建入侵检测模型(COFIDS模型)的新方法,该模型采用kNN(k-NearestNeighbor Classifier)算法实现入侵检测,并利用一种改进的相似因子,来增加系统调用序列间相似度的差别,减少了识别误差,提高了检测率,降低了入侵检测的误报率。实验表明,COFIDS还具有较强的抗噪声干扰的能力。

A new intrusion detection scheme based on the combination of the order and frequency characters of system cails （COFIDS） is proposed. This paper applies a text category algorithm （k-Nearest Neighbor Classifier, kNN） to the proposed intrusion detection scheme. In order to improve the intrusion detection rate, a similarity enhancement factor （SEF） is also presented. The preliminary experimental results demonstrate that the proposed COFIDS can provide obvious improvement in intrusion detection ability. The experiments with COFIDS also show that the proposed scheme has higher ability against to noise in the training data and to intrusion detection false positive rate.