基于K-Nearest Neighbor分类算法的异常检测模型

An anomaly detection model based on K-nearst neighbor classification algorithm

入侵检测成了信息安全中不可缺少的安全措施 ,而异常检测是入侵检测研究中的热点 .提出了一种新的异常检测算法 ,用 K- Nearest Neighbor分类算法对特权程序 (或进程 )的系统调用进行分析 ,通过计算系统调用出现的频度判断进程是否异常 .测试表明 ,该方法具有良好的检测性能和较低的误报率 ,占用的系统资源较少 。

Intrusion detection becomes one of essential information security measures, and the research of intrusion detection focuses on anomaly detection. A new anomaly detection algrithm is proposed. It analyzes the system calls of privileged process through K-nearest neighbor classification algorithm, and it decides whether the process is abnormal by computing the frequency of the system calls. The test result shows that the algorithm is reasonable and feasible for it has good detecting performance and lower false positive rate and it costs a little.