Intrusion detection based on system calls and homogeneous Markov chains

查看全文 作　　者：Tian [1,2]Xinguang;Duan [1,2]Miyi;Sun [1]Chunlai;Li [1,2]Wenfa

机构地区：[1]Inst. of Computing Technology, Beijing Jiaotong Univ., Beijing 100029, P. R. China;[2]Inst. of Computing Technology, Chinese Academy of Sciences, Beijing 100080, P. R. China

出　　处：《Journal of Systems Engineering and Electronics》索引2008年第19卷第3期,共8页

基　　金：the National Grand Fundamental Research '973' Program of China (2004CB318109);the High-Technology Research and Development Plan of China (863-307-7-5);the National Information Security 242 Program ofChina (2005C39). 摘　　要：A novel method for detecting anomalous program behavior is presented, which is applicable to host-based intrusion detection systems that monitor system call activities. The method constructs a homogeneous Markov chain model to characterize the normal behavior of a privileged program, and associates the states of the Markov chain with the unique system calls in the training data. At the detection stage, the probabilities that the Markov chain model supports the system call sequences generated by the program are computed. A low probability indicates an anomalous sequence that may result from intrusive activities. Then a decision rule based on the number of anomalous sequences in a locality frame is adopted to classify the program's behavior. The method gives attention to both computational effciency and detection accuracy, and is especially suitable for on-line detection. It has been applied to practical host-based intrusion detection systems. 关键词：侵入干扰 Markov干扰异常检测系统检测

相关文献

参考文献（16）
引证文献（8）
耦合文献（0）

参考文献(16)

引证文献(8)

互联网出版许可证新出网证(渝)字10号全国400电话 - 免长途话费

Intrusion detection based on system calls and homogeneous Markov chains

参考文献(16)

引证文献(8)

用户提示