摘要
针对基于系统调用序列的入侵检测方法在实际应用中成本偏高的问题,在STIDE方法的基础上提出一种低耗时的入侵检测算法。利用N元语义模型分析系统调用序列规律,计算系统调用的贡献度,抽取最能体现用户正常行为的系统调用,建立正常模式库实现异常检测。实验结果证明,该算法在保证检测率不下降的同时,训练和检测系统调用短序列的规模降低70%。
The existing intrusion detection methods based on sequences of system calls have a large overhead to construct normal profile. An efficient algorithm using statistical language models is proposed based on STIDE in order to reduce the computing cost. The system calls which can represent the characteristics of normal behaviors are extracted by an N-gram method. The improved algorithm extracts the most relevant sequences of system calls. Experimental results demonstrate that the computing cost of the improved algorithm has a reduction of 70% than the standard one and no degradation of detecting rate and false positive rate.
出处
《计算机工程》
CAS
CSCD
北大核心
2010年第5期10-11,14,共3页
Computer Engineering
关键词
统计语言模型
系统调用
入侵检测
statistical language models
system calls
intrusion detection
