摘要
论文提出了一种基于资源操作域的主机防护模型,该模型抛开了基于网络攻击数据特征码匹配构建主机防护系统的传统思路,从系统资源入手,立足于控制进程行为,力求建立一个授权访问系统资源的进程以及操作方法的最小集合。讨论了该模型的构建和运用方法,包括:通过采样、学习和修正这一反复过程构建目标系统的资源操作域;设置防护检查点、截获系统调用、基于资源操作域的检索和匹配等操作进行行为合法性验证。最后,对该模型进行了性能分析。
In this paper,a model is proposed for protecting host based on Resource Operation Domain.The model discards the traditional thought,which using pattern matching for protecting host based on network attack data.At beginning of system resource,control the process behaviors and construct the least set of authorized system processes and processes operated method for special system resource.Construction and using of the model are discussed thoroughly. The ROD of special system is constructed through an iterated process of sampling,learning and modifying.Setting the protected check point,capturing the special system call,searching and matching the ROD validate the system behaviors. At last,performance of the model is analyzed.
出处
《计算机工程与应用》
CSCD
北大核心
2006年第5期152-155,共4页
Computer Engineering and Applications
关键词
主机防护
进程域
资源域操作集
资源操作域
host protected,process domain,resource domain,operation set,resource operation domain
