论文部分内容阅读
基于系统调用的入侵检测一直是软件行为检测的研究热点,该研究的重点已经从单纯考虑控制流特征转变为融合控制流与数据流信息,进而建立更加全面的行为特征模型.为提高基于数据流所建模型的准确性,结合控制流信息提出一种基于参数关系可信度的入侵检测模型.首先,为了降低软件行为分析的复杂度,给出以模式序列进行划分的方法.其次,该模型引入调用属性及属性间关系来描述系统调用之间的数据流特征.最后,为提高模型的精度,引入意外概率和支持度两个因素,通过计算得到了参数关系的可信度,利用关系可信度判断某行为是否属于入侵.实验结果表明,基于上述方法建立的模型不仅可以检测出大量异常,还可以量化异常程度,提高异常行为判定的准确性.
Intrusion detection based on system call has always been a hot research topic in software behavior detection, and the emphasis of this research has shifted from simply considering control flow characteristics to converging control flow and data flow information, so as to establish a more comprehensive behavior characteristic model.In order to improve the data flow based on data flow In order to reduce the complexity of software behavior analysis, a method of partitioning by pattern sequence is proposed.Secondly, the model is built based on the accuracy of the model.Combined with the information of control flow, an intrusion detection model based on parameter- Introducing the relationship between attributes and attributes to describe the characteristics of data flow between system calls.Finally, in order to improve the accuracy of the model, the author introduces the factors of accidental probability and support degree, and obtains the credibility of the parameter relationship by using the relationship The test results show that the model based on the above method can not only detect a large number of anomalies, but also quantify the degree of anomalies and improve the accuracy of anomaly determination.