计算机应用 ›› 2012, Vol. 32 ›› Issue (12): 3439-3444.DOI: 10.3724/SP.J.1087.2012.03439

• 信息安全 • 上一篇    下一篇

基于进程轨迹最小熵长度的系统调用异常检测

吴瀛1,2,江建慧2   

  1. 1. 安徽建筑工业学院 计算机科学与技术系，合肥 230022
    2. 同济大学 软件学院，上海 201804
  • 收稿日期:2012-06-14 修回日期:2012-07-27 发布日期:2012-12-29 出版日期:2012-12-01
  • 通讯作者: 吴瀛
  • 作者简介:吴瀛(1970-), 男, 安徽宿松人，讲师，博士研究生，主要研究方向:信息安全、入侵检测、机器学习；〓江建慧(1964-), 男, 浙江淳安人，教授，博士生导师，主要研究方向：可信计算、软件可靠性工程、计算机辅助技术(设计、测试与评估)。
  • 基金资助:
    国家863计划项目

System call anomaly detection with least entropy length based on process traces

WU Ying1,2,JIANG Jian-hui3   

  1. 1. Department of Computer Science and Technology, Anhui Institute of Architecture and Industry, Hefei Anhui 230022, China
    2. School of Software Engineering, Tongji University, Shanghai 201804, Chin
    3. School of Software Engineering, Tongji University, Shanghai 201804, China
  • Received:2012-06-14 Revised:2012-07-27 Online:2012-12-29 Published:2012-12-01
  • Contact: WU Ying

PDF

摘要： 进程的系统调用轨迹蕴藏着程序行为不变性和用户行为不变性这两种不变性，其中，程序行为不变性可进一步细分为时间顺序不变性和频度不变性。已有的系统调用异常检测技术研究工作均集中于程序行为不变性，忽视了用户行为不变性。从系统调用中的频度不变性出发，研究了系统调用轨迹中的用户行为不变性及其描述手段，并提出采用最小熵长度描述这种不变性。在 Sendmail 数据集上的实验表明，最小熵长度较好地描述了系统调用轨迹中的用户行为不变性，结合程序行为不变性，可以极大地提高系统调用异常检测性能。

关键词: 入侵检测, 系统调用, 程序行为不变性, 用户行为不变性, 最小熵长度

Abstract: In system call trace of a process, there are two kinds of invariability, program behavior invariability and user behavior invariability, of which the former can be further subdivided into temporal order invariability and frequency invariability. The existing researches on system call based intrusion detection techniques focus on program behavior invariability only, ignoring user behavior invariability. Based on frequency invariability embedded in process traces, the existence and description of user behavior invariability were studied, on which the least entropy length was proposed to measure the invariability. The experiment on Sendmail datasets shows that, least entropy length excellently describes user behavior invariability and significantly improves the performance of system call anomaly detection with the help of program behavior invariability.

Key words: intrusion detection, system call, program behavior invariability, user behavior invariability, least entropy length

中图分类号: 

版权所有 © 2021 四川计算机应用杂志社有限公司
蜀ICP备 05010208 号-3　新出网证(川)字026号
技术支持：北京玛格泰克科技发展有限公司
访问总数：
今日访问：