摘要
提出了一种基于系统调用序列的入侵检测模型,利用绝对安全环境下的应用程序系统调用序列建立正常行为模式。当发现实际系统调用序列模式与正常的行为模式不匹配时,标记为入侵,并采取应急措施。一个例程管理一个进程,给出了模式的适应度计算方法以及两个生成下一代模式的算子。实验结果表明:入侵检测模型与现有的一些模型相比,具有更好的准确性和更高的效率。
In this paper an intrusion detection model based on system call sequences is proposed, and a normal activity mode of the system call sequences in absolute security environment is established. If the model finds the real system call sequences mode of the process does not match the normal activity mode, it will flag the process as intrusion and take some actions to respond to it. One instance of the model monitors one process. And a new method of calculating the fitness and two operators to generate the next offspring are provided. The experimental results demonstrate that compared with some of the current models, the model presented in this paper is more veracious and more efficient.
出处
《西华大学学报（自然科学版）》
CAS
2005年第3期75-77,共3页
Journal of Xihua University:Natural Science Edition
关键词
网络系统
入侵检测
系统调用序列
异常检测
模式匹配
network system
intrusion detection
system call sequences
anomaly detection
pattern match
