基于有监督矢量的量化分析与Markov模型的异常检测方法

An Analysis Based on Supervised Vector Quantization and an Abnormity Detection Method of the Markov Model

从分析特权进程系统调用序列的特点入手,利用矢量量化方法对特权进程的短系统调用序列进行聚类分析,进而利用Markov模型来学习聚类之间的时序关系。本方法在矢量量化中利用动态分裂算法对短系统调用序列进行聚类分析,增大了正常进程系统调用序列与异常进程系统调用序列间的差异性;在训练数据集很小的条件下使模型更精小、实时性强、占用系统资源少,适合于实时检测。

Starting with the analysis of the characteristics of command- sequence in process privilege system, this paper uses Vector Quantization method to cluster and analyze short system command - sequence and employs Markov model to study the relationship of timing sequence of clusters. In this paper, the method of using dynamic splitting calculation to cluster and analyze the command- sequence of short system in vector quantization, greatly enhance the othemess between the command - sequence of normal proceeding system and the command- sequence of abnormal proceeding system, and bring out some advantages, such as reducing the model, no timing mistakes, small occupation on system resources, timing check when the sample of practice data is small.