摘要
提出了一种变长序列模式的寻找算法,从训练序列中找出一组基本相对独立的变长序列模式,并在模式集的更新过程中自动定义了模式间的前后次序关系,以此构建了一个描述进程执行模式的DFA。针对已有基于变长序列模式的模式匹配算法需要向前预测若干个系统调用号的缺点,设计了一个更好的模式匹配算法。实验结果表明,算法在模式寻找过程中是稳定的,并在保持小规模模式集的情况下,取得了很低的误报率和漏报率。
A new algorithm for the variable-length pattern from system call sequences is proposed. It is the way to present a novel simple technique to build a table of variable-length patterns from the training system call sequences , so as to find out a set of basic and relatively independent variable - length patterns. With this me - thod, all the possible relationships between the variable-length tation of the program is constructed, and an evaluation scheme patterns are found out. An exact DFA represen- is proposed for the variable-length patterns. The experimental results indicate that this algorithm can generate a relative small set of patterns, and obtain very low false positives and false negatives.
出处
《江苏科技大学学报（自然科学版）》
CAS
北大核心
2007年第3期36-41,共6页
Journal of Jiangsu University of Science and Technology:Natural Science Edition
基金
江苏省教育厅
江苏科技大学资助课题(2005DX006J)
关键词
入侵检测
系统调用
模式匹配
变长序列模式
intrusion detection
system call
pattern matching
variable-length pattern
