基于不定长模式的马尔可夫入侵检测方法

Intrusion Detection Method Based on Markov and Variable-Length Pattern

入侵检测技术是截止到目前为止最为有用的网络安全防范工具，而基于系统调用序列的检测方法是其中一个非常重要的分支。然而，寻找不定长模式确是这类研究中相当困难的一个任务，设计动态模式提取法，并进一步以此为基础提出了基于马尔可夫的检测方法。最后通过大量试验及与现有算法的比较证明了此方法的有效性，即能在两个传统评价指标（检测率和误报率）上取得更好的结果。

Intrusion detection is one of the most effectiveness network security defense and it is getting more and more attentions. The research of anomaly detection methods based on system call sequences is an important branch in the research of host-based intrusion detec- tion. Variable-length patterns seem to be more naturally suited to model the process behavior, but they are also more difficult to construct from system call sequences. In this paper,a novel method is proposed to construct variable-length patterns by using dynamically extracting information from call stack of the process. Then a Markov chain model is constructed based on variable-length patterns to detect abnormal behaviors. The experimental results in- dicate that compared with traditional method, the proposed method can generate a smaller set of patterns and obtain better results compared with traditional method.