基于行为策略的主动防御系统设计

The design of the active defense system based on behavior strategy

针对特征码扫描方法的不足,提出了一种基于程序的行为授权委托模型来判断执行程序是否为恶意代码的方法,对进程的权限进行控制,对程序的行为和系统的关键资源进行监控、自动分析、自动诊断,建立了一套较为完善的入侵自动检测报警机制,为权限控制增加了主动防御功能。试验结果表明,本方法有利于进一步加强管理信息系统的安全。

Considering the deficiency of scanning features,we propose a program-based behavior authorization model for the monitoring,auto analysis and diagnosis of the key resources of the computer program and system.Thus we set up an automatic intrusion detection alarm system which enables the access control better defense.Our experiment indicates that the method demonstrated in this paper is proved to be benefitial the safety of the management of information system.