基于系统调用序列及参数的异常检测研究

发布时间：2018-04-28 23:15

本文选题：系统调用 + 控制流　；参考：《东华大学》2014年硕士论文

【摘要】：计算机系统安全问题日益突出,异常检测技术由于具备检测未知攻击的能力越来越受到普遍关注。异常检测可以分为基于网络和基于主机的异常检测,本文讨论主要是基于特定主机尤其是在网络上提供网络服务的服务器主机的异常检测。好的监测对象能够很好的反映程序的行为轮廓,在基于主机的异常检测当中主要是以系统调用作为监测数据源。传统基于主机的异常检测方法通过监测系统调用的数据流或控制流来发现入侵行为,基于控制流分析的异常检测系统通过监测系统调用序列,构建序列的各种模型来反映程序的控制执行流,而基于数据流分析的异常检测系统监测各系统调用参数及返回值之间的数据传递。目前的研究中除了指出在数据流分析中加入简单控制流信息可以提高检测精度外,在这两者的研究方向上出现了很大的分化,不能很好的吸收彼此的研究成果,造成了程序行为轮廓构建的不完备和不准确。基于这种情况,本文提出了一种新的综合控制流与数据流分析的新方法。该方法首先使用系统调用定长序列构建模式库,再用关联规则挖掘方法挖掘同一模式或不同模式下属性间的关联规则,构建用于检测评估的两种规则集。本文最后对提出的模型进行了仿真测试。实验结果表明,基于控制流上下文的数据流分析新方法能够发现先前数据流分析所不能发现的更精准更有用的规则从而检测出更多的异常行为。
[Abstract]:The security problem of computer system is becoming more and more serious. Anomaly detection technology has attracted more and more attention because of its ability to detect unknown attacks. Anomaly detection can be divided into network-based and host-based anomaly detection. This paper mainly discusses anomaly detection based on specific hosts, especially server hosts that provide network services on the network. A good monitoring object can well reflect the behavior profile of the program. In the mainframe based anomaly detection, the system call is mainly used as the monitoring data source. The traditional anomaly detection method based on host can detect the intrusion behavior by monitoring the data flow or control flow of the system call, and the anomaly detection system based on the control flow analysis monitors the system call sequence. Various models of the sequence are constructed to reflect the control execution flow of the program, while the anomaly detection system based on the data flow analysis monitors the data transfer between the system call parameters and the return values. In the current research, besides pointing out that adding simple control flow information to the data flow analysis can improve the detection accuracy, there is a great differentiation between the two research directions, which can not absorb each other's research results very well. It results in the incompleteness and inaccuracy of program behavior profile construction. Based on this situation, a new method of integrated control flow and data flow analysis is proposed in this paper. In this method, firstly, the fixed length sequence is used to construct the schema library, then the association rules mining method is used to mine the association rules between the attributes of the same pattern or different patterns, and two rules sets are constructed to detect the evaluation. Finally, the proposed model is simulated and tested. Experimental results show that the new data flow analysis method based on control flow context can find more accurate and useful rules that cannot be found by previous data flow analysis and detect more abnormal behaviors.
【学位授予单位】：东华大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【参考文献】