【摘要】 提出了一种基于系统调用、面向进程的Linux系统入侵检测方法:利用LKM(Loadable Kernel Modules)技术在Linux内核空间获取检测源数据——所考察进程的系统调用,使用基于极大似然系统调用短序列的Markov模型提取进程的正常行为特征,据此识别进程的异常行为。通过实验表明了此方法的可行性和有效性;并分析了方法在实现中的关键问题。更多还原

【Abstract】 A process-orientated intrusion detection method based on system call for Linux system was proposed: The LKM(Loadable Kernel Modules) technology running in the kernel space was used to obtain the system calls of a process,and the Markov model based on the maximum likelihood syscall short sequences was used to describe the normal profile and to detect the anomaly of a process.Experiments show good feasibility and validity of this scheme.Some key problems of the implementation for the scheme were discussed.更多还原