基于系统调用分类的异常检测.pdf

3 1000—982纠2004／15(03)0391@2004Joumalofsonware软件学报 v。1．15，No 基于系统调用分类的异常检测+ 徐明+，陈纯，应晶 (浙江大学计算机科学与工程学系，浙江杭州310027) DetectionBasedon CallCIassification Anomaly System XU CHEN YING Ming‘， Chun， Ji“g sclenceand (DepanmeⅡtofcomputer E“g{need“g’zh西ia“gunlversity，H孤gzhou310027，chin日 educn， com，http：／，wwwcs巧u +coHespondl“g鲫thor：Phn：十86—571E-mail：xuming一903@tom Received 2003-07-02 2002—10—10；Accepted xu de抛c抽Ⅱhasedon M，ch衄c，Yjng sysfem J．AHomaJy caⅡclngsmcⅡdon．胁珊“盯＆归御仲，2004，15p)： 39l~403． 1：h虹 n蛳：』生盟坠】Q￡：Q!g：型!QQQ：1825』!§』31 Abstract：’rkalmofthi8 is tocrea把anew detectionbasedonnlles．Adeta“ed p叩er anomaly mo如1 cIassi疗c“onoftheLINUXcalIs tothe打血ncnonandleveIofthre“i8 detection systemacco删ng p瑚ented，The at mreatlevel1 detectlonmodel modeIaimscriticalcalls(i．e．the the only calls)．Inleami“gproce8s，the not data or staticdata critical dOes use statistic8矗Om dyna训callyprocessesevory c“l，but mining Therefore，the incrememcouldbe onsome rulesand numberof九lles s1唧1e 1eaming irnplemented．Basedprede丘Ⅱed refhing，the inthemledatabasecouldbere血Iced thattherulematch廿mecallbereduced dr咖