【作者】 刘泉永；

【导师】 吕锋；

【作者基本信息】 武汉理工大学 ， 通信与信息系统， 2006， 硕士

【摘要】 基于主机系统调用序列的入侵检测技术,是针对主机系统调用数据进行监测的一种安全技术。由于主机系统调用序列反映了系统内核的行为特征,有利于对于系统自身特征的提取和针对系统自身的监测,从而可以不考虑用户差别,从系统自身行为的合法性和破坏性上鉴别入侵行为,有效地控制和监管特权程序的使用,辨别滥用职权的发生。同时,这种基于序列模式的分类研究对于其他基于序列的检测技术,例如基于用户命令序列的入侵检测提供了可以借鉴的方法。 本文主要研究了基于主机系统调用入侵检测系统的检测分类算法。基于主机系统调用入侵检测模型的关键就是如何能够更准确地把从系统中得到的系统调用序列进行分类,为此,文中引进了应用于文本分类系统中的KNN分类算法(K-Nearest Neighbor),原本用在word里面用来检测单词正确与否的算法。用文本处理的方法,每个系统调用被看成是在一份很长的文档中的一个字,而且一个进程所产生的系统调用集被看作是那份文档。这样一来就可以把原来用来处理文本过程的方法完整的应用到入侵检测问题上。KNN分析就是一种新的,基于KNN分类的入侵监测的方法。 本文把KNN算法应用到基于主机入侵检测系统中,设计了一个基于KNN算法的主机入侵检测系统,论文的研究、设计工作主要包括以下几个方面:1 分析了网络安全的现状,对入侵技术及其发展作了总结;2 研究了基于系统调用入侵检测系统的基本工作原理和算法实现,并介绍了KNN算法,给出了算法的向量空间描述以及特征值计算方法;3 设计了基于系统调用的入侵检测系统模型,介绍了模型的设计思想,描述了模型的各个功能模块的详细实现;4 最后对算法进行了测试,表明KNN算法的分类检测准确率比较高,是一种比较好的入侵检测分类算法。更多还原

【Abstract】 The technique of intrusion detection based on sequence of host system call mainly focused on the data set of host system call, which is the kernel function of an operating system. As the character of kernel of operating system, sequence of system call can be used to detect the behavior of system without care of differentiation of user, and can be more effective in controlling the usage of privilege program and in preventing abusing.The paper mainly studys the detection categorization algorithm of intrusion detection system based system call. Key of the model of HIDS is how to categorize the systems got from processions well and truly. For this reason, we introduce into the KNN algorithm which is used in text categorization system. KNN namely K-Nearest Neighbor, is used to test the word right or nor in WORD. Here each system call in the processes treated as a word and the collection of system calls over each program execution as a document, and thus the method dealing text process is applied to intrusion detection. KNN analysis is a new intrusion detection method which bases KNN categorization.We apply KNN into HIDS, and design a HIDS based KNN algorithm. The research, design and realizing working mainly of the thesis include several following respects: 1 Analyses the current situation of the network security, make a summary of intrusion technology and development;Through the study of basic construction and algorithm realizing of intrusion detection system on sequence of host system call, introduce the KNN algorithm and describe the vector space of KNN. 3 Design the model of intrusion detection system based system call and introduce the function of each module and realization;3 Finally, we do a test of KNN algorithm through experimentation, and the result show that the KNN algorithm’s accurately leads is satisfying, and is a good categorization algorithm in intrusion detection.更多还原