基于主机系统调用的入侵检测方法研究

RESEARCH THE METHODS TO DETECT INTRUSIONS USING SYSTEM CALL-BASED HOST

大多数的入侵行为是由于一系列操作系统内部的非法或异常调用引起的,因此对系统调用序列进行分析是入侵检测的一个重要方法。给出了两种基于系统调用的序列分析方法:基于频繁统计和基于权值树的滑动窗口序列分析方法,并且描述了相应算法的主要过程。并通过试验证明了它们的合理性和有效性。

Sequence analysis to system call sequences is an important method in intrusion detection, for most of the system intrusions are conduced by illegimate or irregular system calls to operation system. This paper puts forward two methods for sequence analysis of sliding windows based on frequency counting and weight trees, and describes their principles and algorithms in detail. They are proved to be effective by the experiments in the public data sets.