基于程序合法作用域的入侵检测系统的研究

Intrusion detection based on program’s legal function area

通过分析应用程序在执行时的系统调用序列,提出了一种新的基于程序合法作用域的入侵检测方法。合法作用域的建立以程序的系统调用信息为依据,并采用了有限状态自动机对其进行建模,每一个合法作用域由一个状态来表示,它包含程序运行时的有效用户标示和有效组标示,然后据此检测系统的异常行为。实验结果表明,该方法可以检测到利用应用程序代码漏洞而发起的攻击,并且有较低的错误警报率。

By analyzing the system calls of a running process,a new intrusion detection method based on application’s ＂Legal Function Area＂is proposed.The ＂ Legal Function Area＂ is established by analyzing the system call information,and it is modeled by using finite-state machine,and every ＂ Legal Function Area ＂ is represented by one state which includes the euid and egid of the running process.A preliminary experiment shows that the new method can detect various attacks towards code vulnerabilities,and has a low false positive.