【作者】 尹清波；

【导师】 张汝波；

【作者基本信息】 哈尔滨工程大学 ， 计算机应用技术， 2004， 硕士

【摘要】 入侵检测技术是现代计算机系统安全技术中的重要组成部分，并且是当前的研究热点。 目前，绝大多数入侵行为都通过攻击特权进程来破坏计算机系统的安全性。特权进程通常完成特定的、有限的行为，所以其行为在时间上和空间上比其他用户程序要更稳定。一定的系统调用排列应对应一定的程序功能，即程序行为的局部规律性应很强。并且入侵行为应具有某种功能行为特性，即系统调用序列应具有特定顺序排列。对每一个系统调用赋予一个数值，则可以将系统调用序列看作是一个时间序列。因此，可以用数字信号处理与时间序列分析的方法来处理，对入侵和正常两种信号进行分类。这样，可以从短系统调用序列所要完成具体功能的确定性来提取局部特征；通过对进程的运行过程进行观察，利用随机过程的知识建立随机模型来描述系统调用序列(进程)的整体行为。 本文提出了基于线性预测与马尔科夫模型相结合的入侵检测方法。首先提取特权进程的行为特征，引入时间序列分析技术——用线性预测技术对特权进程产生的系统调用序列提取特征向量来建立正常特征库，并在此基础上建立了Markov链模型。由MarkoV链模型产生的状态序列计算状态概率，根据状态序列概率来评价进程行为的异常情况。然后，利用马尔科夫信源熵进行参数选取，对模型进行优化，进一步提高了检测率。实验表明该算法准确率高、实时性强、占用系统资源少。本文所提方法算法简单、预测准确，适合于进行实时检测。更多还原

【Abstract】 Intrusion detection is very important in the defense-in-depth network security framework and a hot topic in computer network security in recent years.At present, most of the attacks exploit the vulnerabilities or flaws of the privileged processes in computer. A program profile can be generated by monitoring the program execution and capturing the system calls associated with the program. Compared to user behavior profiles, program profiles are more stable over time because the range of program behavior is more limited. Furthermore, it would be more difficult for attackers to perform intrusive activities without revealing their tracks in the execution logs. Therefore program profiles provide concise and stable tracks for intrusion detection. Now, almost all the research in learning program behavior has used short sequences of system calls as the observable, and generated a large individual database of system call sequences for each program. A program’s normal behavior is characterized by its local ordering of system calls, and deviations from their local patterns are regarded as violations of an executing program. In the past, we deal with the sequence as a feature. But we don’t find out the relationship between the features. So the capability is very limited, when we only use the limited data to train.In this paper, a new method based on linear prediction and Markov chain model is proposed to learn program behavior in intrusion detection. Linear prediction is employed to extract features from system calls sequences of the privileged processes, which are used to make up of the feature database of those processes by only considering the system calls of privilege programs as time series, and then the Markov chain model is founded based on the features, and Markov information source entropy and condition are used to select parameter and optimize the model. The merits of the model are simple and exact to predict. The experiments show this method is effective and efficient in real time and light load, and can be used to in practice to monitor the computer system in real time.更多还原