基于变长系统调用序列模式的入侵检测方法研究

提出了一种变长序列模式的寻找算法,从训练序列中找出一组基本相对独立的变长序列模式,并在模式集的更新过程中自动定义了模式间的前后次序关系,以此构建了一个描述进程执行模式的DFA。针对已有基于变长序列模式的模式匹配算法需要向前预测若干个系统调用号的缺点,设计了一个更好的模式匹配算法。实验结果表明,算法在模式寻找过程中是稳定的,并在保持小规模模式集的情况下,取得了很低的误报率和漏报率。

Intrusion Detection Using Variable-length System Call Pattern

A new algorithm for the variable-length pattern from system call sequences is proposed.It is the way to present a novel simple technique to build a table of variable-length patterns from the training system call sequences,so as to find out a set of basic and relatively independent variable-length patterns.With this me-thod,all the possible relationships between the variable-length patterns are found out.An exact DFA representation of the program is constructed,and an evaluation scheme is proposed for the variable-length patterns.The experimental results indicate that this algorithm can generate a relative small set of patterns,and obtain very low false positives and false negatives.