【摘要】 该文针对现有的异常检测方法大多只关注系统调用出现的频率或者局部变化的情况,提出了一种将动态行为和全局特征结合起来的检测模型(DBCPIDS).文章针对满足支持度要求的系统调用短序列,给出了特征模式的概念,并以此为基础提出了基于改进的隐马尔科夫方法(IHMM).当利用该模型进行检测时,首先用程序轨迹匹配特征模式,如果不匹配再用IHMM进行检测,从而使得该检测模型充分利用了程序正常运行的全局特征和程序运行期间的局部变化.通过实验表明,利用该模型进行异常检测,具有很高的检测率和较低的误报率.更多还原

【Abstract】 Differing from existed anomaly detection methods which only dealt with the frequencies of system calls or local variation,the paper puts forward a model named DBCPIDS.It took in both dynamic behavior and character patterns of programs.In this model,the authors defined the short sequence of system calls as a character pattern if this sequence satisfied the certain support degree,and propose an improved HMM(IHMM) on this basis.When detecting intrusions,firstly,we would judge whether the program trace is matched character patterns.If not,then the authors would use IHMM to detect.The model can not only reflect the global character of the program normal traces,but also pay much attention to the local warp in the execution.The experiments results show that the authors can get higher detection rate and lower false positive rate with DBCPIDS.更多还原