一种基于最大熵原理系统异常检测模型研究

Research on an Abnormal Detect Model for System Call Sequence Using Maximum Entropy Principle

大多数基于系统调用序列分析的系统异常检测方法在对系统调用序列裁减和特征提取过程中没有客观评估特征表述进程行为的能力,其结果造成了许多误警、漏警问题,影响了检测性能.提出了一种基于最大熵原理的系统异常检测模型,通过计算互信息量和Z测试实现特征提取,通过构建最大熵模型实现特征评估与检测分类器.通过改进BloomFilter算法实现高效的特征查找或匹配.较好的改善了系统异常检测的性能,对比实验结果证明,该检测模型能够以较高的精确度及时的检测出异常攻击行为.

Now most of the Abnormal Detect Methods based on System Call Sequence analysis can＇t evaluate the capability of features characterizing process＇s behavior in the process of system call sequence reduction and feature selection, which causes many missed warnings and performance problems. In this paper, we propose a new abnormal detect model using maximum entropy principle, which achieves feature selection using mutual information and Z-Test, feature evaluation and systematizer using maximum entropy model. , and an efficient searching and matching process by reforming the Bloom Filter algorithm. In this way , our model may improve the performance of the system abnormal detecting greatly. A contrast experiment has been testified that we can find out the abnormal attack behavior immediately on a higher orecision level.