【摘要】 文章在深入分析免疫系统的基础上,提出了一种针对系统调用序列的高效低负的异常检测方法,该方法借助粗糙集理论分析进程正常运行时产生的系统调用序列,提取最简的预测规则模型。与其他方法相比,用粗糙集理论建立正常模型要求的训练数据获取简单,生成的小规则集利于实时检测,能更有效地检测进程的异常运行状态。具有这样免疫特性规则模型可以在局部和全局不同层次上检测入侵攻击,具有较好的自适应性、可扩展性和智能性。实验证明该方法的检测效率明显优于其他建模方法。更多还原

【Abstract】 A high-efficient and low-loading abnormal detecting method aiming at system calls sequences based on complete analyzing the immunity theory is put forward.The method by using the rough set theory analyzes the system calls sequences created by the normal running processes;and extracts a set of forecasting rules model with the minimum size.Compared with other methods,there are some merits using the Rough set theory to create the normal model.Namely,it is simple to get the training data,the small rule set is advantage to real-time detection,and the process’ abnormal running state can be detected out effectively.The rules modules with the trait of immunity can detect intrusion attack in part and the whole network.These modules have better adaptability,expansibility and intelligence.Experiment results show that the efficiency of the method in this paper is obviously better than other methods.更多还原