【作者】 尹清波；

【导师】 张汝波；

【作者基本信息】 哈尔滨工程大学 ， 计算机应用技术， 2007， 博士

【摘要】 入侵检测技术是现代计算机系统安全技术中的重要组成部分，并且是当前的研究热点。目前，绝大多数入侵行为都通过攻击特权进程来破坏计算机系统的安全性。特权进程通常完成特定的、有限的行为，所以其行为在时间上和空间上比其他用户程序要更稳定。本文以入侵检测的核心技术检测模型为研究对象，以操作系统的系统调用为研究内容，以提高异常行为的识别能力、减少误警率为目标，从研究正常行为与异常行为的差异入手提出一个基于马尔科夫模型的入侵检测框架，在此基础上步步深入研究三个基于马尔科夫模型的异常检测模型。主要研究内容如下：(1)结合系统调用序列的特点，提出基于机器学习的入侵检测系统框架。入侵检测本质上是一个分类问题，而分类问题要以学习为前提。从机器学习所涉及到的一致性假设，划分与泛化能力三方面内容着手，详细分析了入侵检测系统数据的来源，数据的特征(划分)及算法的泛化能力。在此基础上指导入侵检测算法设计。通过分析正常进程的系统调用序列与异常系统调用序列的异同，可知进程的系统调用具有如下的特性：(1)局部规律性很强；(2)正常进程的系统调用与异常进程的系统调用序列具有不同的分布特性。特定的程序有特定的、相对稳定的结构，因此将确定性方法(短序列建库)与随机性方法(马尔科夫模型)相结合来建立模型。进程的系统调用具有的局部性与马尔科夫模型有天然的联系，因此在这一框架中用马尔科夫模型作为分类器。在PAC学习理论下分析检测模型的样本复杂度；通过对算法偏置与泛化能力的讨论，利用结构风险最小化原则指导学习机的设计。(2)利用时间序列分析技术提取特征，提出了基于线性预测的入侵检测方法。从提取特权进程的行为特征入手，引入时间序列分析技术——用线性预测技术对特权进程产生的系统调用序列提取特征向量来建立正常特征库，并在此基础上建立了马尔科夫模型。由马尔科夫模型产生的状态序列计算状态概率，并根据状态序列概率来评价进程行为的异常情况。然后，利用马尔科夫信源熵和条件熵进行参数选取，并对模型进行优化。(3)提出了基于矢量量化分析与马尔科夫模型相结合的入侵检测方法。针对传统监督学习的缺点，本文将聚类分析应用于有监督学习，提出了基于矢量量化分析与马尔科夫模型相结合的入侵检测方法。首先利用矢量量化方法对正常特权进程的短系统调用序列进行聚类分析，进而利用马尔科夫模型来学习聚类之间的时序关系。在矢量量化中利用动态分裂算法对短系统调用序列进行聚类分析，充分提取特权进程的局部行为特征的相互关系，因此可以在训练集很小的条件下使模型更精确、检测能力大大增强。(4)提出基于K-means与马尔科夫模型相结合的半监督异常检测方法。分析现有基于监督学习或非监督学习入侵检测方法优缺点的基础上，提出了一个新颖的基于K-means与马尔科夫模型相结合的半监督异常检测方法。半监督方法的学习样本包括已标示类别的样本和未标示样本，并且通过对已标示的样本的学习来指导对未标示样本的学习来提高识别率。本方法首先将经过标示的(正常的)系统调用序列投影到高维空间进行有监督聚类后，利用马尔科夫模型来学习聚类间的时序关系，建立起正常行为的初始模型。由马尔科夫模型产生的状态序列计算状态概率，根据状态序列概率来评价进程行为的异常情况。正常行为模型由两种关系确定：1)空间分布关系(聚类)；2)空间的时序关系(马尔科夫模型)。在初始模型的导引下对未标示的序列进行学习，利用迭代过程对模型进行改进。实验表明该算法能够在已标示样本较少的情况下通过对未标示样本的学习来改善模型的检测性能，达到在线增量学习的目的。更多还原

【Abstract】 Intrusion detection is very important in the defense-in-depth network security framework and a hot topic in computer network security in recent years.At present, most of the attacks exploit the vulnerabilities or flaws of the privileged processes in computer. Compared to user behavior profiles, program profiles are more stable over time because the range of program behavior is more limited. Furthermore, it would be more difficult for attackers to perform intrusive activities without revealing their tracks in the execution logs. Therefore program profiles provide concise and stable tracks for intrusion detection. A program’s normal behavior is characterized by its local ordering of system calls, and deviations from their local patterns are regarded as violations of an executing program.This thesis concentrates on algorithms of intrusion detection, which is one of the most important problems of intrusion detection, and has used short sequences of system calls as the observable. And its aim is to improve the capability of classification and reduce misclassification. A framework is founded based on markov model, which can use properly the characteristics of the system call sequences of process profile. According to this framework, three anomaly detection methods were proposed with research of the theories step by step.The main contents of this thesis presents are in the following four topics:(1) Propose a novel framework based on markov model combined two characteristics of system call sequences of process profile.After the familiar attack methods were analyzed, it was known that the system call sequences of process profile have two characteristics: 1) local ordering; 2) different distributing between normal and abnormal. Because the system call sequences of program profiles provide concise and stable tracks, a markov model can be used to construct a framework, which imposes two characteristics of system call sequences, to detect intrusion detection.(2) Propose a method based on Linear predictive, which utilizes the technologies of time sequences analysis to extract features.A new kind of method for anomaly intrusion detection is proposed based on linear prediction and markov model. At first, linear prediction technique is employed to extract features from system call sequences of the privileged processes which are used to make up of the character database of those processes, and then the markov model is founded based on the features; and markov information source entropy and condition entropy are used to select parameter and optimize the model. The merits of the model are simple and exact to predict. But, it has a obvious disadvantage that it needs a large number of samples for training because this method is a supervised method.(3) Propose a method based on vector quantization.To avoid the shortcoming of the supervised methods, a new kind of method for anomaly intrusion detection is proposed based on vector quantization and Markov model. At first, vector quantization technique is employed to extract features from system call sequences of the privileged processes, and then the Markov model is founded based on the features. The observed behavior of the system is analyzed to infer the probability from the Markov model, which is used to judge an anomalous behavior that may result from intrusive activities(4) Propose a semi-supervised learning method based on the combination of K-means and Markov model.To avoid the shortcoming of the supervised methods, a novel semi-supervised learning method for anomaly intrusion detection is proposed based on the combination of K-means and Markov model. At first, the algorithm trains a classifier using the available labeled system calls sequences to cluster and found the Markov model through these clusters. The observed behavior of the system is analyzed to infer the probability from the Markov model, which is used to judge an anomalous behavior that may result from intrusive activities. It then trains a new classifier using the labels for all the sequences, and iterates to convergence. The experiments show the accuracy of this method can be improved by augmenting a small number of labeled training system call sequences with a large of unlabeled system calls sequences.更多还原