摘要
Behaviour detection models based on automata have been studied widely. By add- ing edge ε, the local automata are combined into global automata to describe and detect soft- ware behaviour. However, these methods in- troduce nondeterminacy, leading to models that are imprecise or inefficient. We present a model of software Behaviour Detection based on Process Algebra and system call (BDPA). In this model, a system call is mapped into an action, and a function is mapped into a process We construct a process expression for each function to describe its behaviour. Without con- strutting automata or introducing nondeter- minacy, we use algebraic properties and algo- rithms to obtain a global process expression by combining the process expressions derived from each function. Behaviour detection rules and methods based on BDPA are determined by equivalence theory. Experiments demon- strate that the BDPA model has better preci- sion and efficiency than traditional methods.
Behaviour detection models based on automata have been studied widely.By adding edgeε,the local automata are combined into global automata to describe and detect software behaviour.However,these methods introduce nondeterminacy,leading to models that are imprecise or inefficient.We present a model of software Behaviour Detection based on Process Algebra and system call(BDPA).In this model,a system call is mapped into an action,and a function is mapped into a process.We construct a process expression for each function to describe its behaviour.Without constructing automata or introducing nondeterminacy,we use algebraic properties and algorithms to obtain a global process expression by combining the process expressions derived from each function.Behaviour detection rules and methods based on BDPA are determined by equivalence theory.Experiments demonstrate that the BDPA model has better precision and efficiency than traditional methods.
基金
supported by the Fund of National Natural Science Project under Grant No.61272125
the Specialized Research Fund for the Doctoral Program of Higher Education under Grant No.20121333110014
the Hebei Provincial Natural Science Foundation under Grant No.F2011203234