【摘要】 主要研究W indows平台下的异常检测方法,提出一种利用W indows Native API调用序列和基于决策树算法的主机服务进程模式抽取算法,并通过在模式中引入通配符而大大缩减了模式集的规模。进一步引入了表征模式间关系的转移概率,建立了模式序列的全局马尔可夫链模型,并给出了相应的异常检测算法。实验结果表明:该算法可以抽取一个规模较小且泛化能力较强的模式集,相应的检测算法可以有效地检测异常。更多还原

【Abstract】 Anomaly detection algorithm for Windows platform is studied.A host process pattern extraction algorithm using Windows Native API sequences and based on decision tree is presented,and a wildcard is introduced in patterns,so the size of pattern set is reduced considerably.More over,transition probabilities between patterns are computed to build a global Markov Chain Model of pattern sequences,and related anomaly detection algorithm is presented.Experiments demonstrate that the algorithms can extract a pattern set of small size and high generalization ability,and can detect anomalies effectively.更多还原