摘要
设计了基于写相关支持向量描述的安全审计模型来实现一个新的单类分类器,对系统调用中"写性质"子集进行监视和分析,并以此训练单类分类器,使偏离正常模式的活动都被认为是潜在的入侵。该模型仅利用正常样本建立了单分类器,因此系统还具有对新的异常行为进行检测的能力。通过对主机系统执行迹国际标准数据集的优化处理,只利用少量的训练样本,实验获得了对异常样本100%的检测率,而平均虚警率接近为0。
The security audit model based on write-related SVDD was designed to resolve the one-class problem. Once the classifier has been trained using the write-related subset, all activities deviated from the normal patterns are classified as potential intrusion. The proposed one-class classification algorithms can be implemented to build up an anomaly detection system by using only normal samples and the algorithms also makes the security audit system detect the new anomaly behaviors. In the experiments, the One-class classifier acquires nearly 100% detection rate and average zero false alarm rate for sequences of system calls based on a small training dataset.
出处
《通信学报》
EI
CSCD
北大核心
2007年第7期8-14,共7页
Journal on Communications
基金
国家自然科学基金资助项目(60603029)
江苏省自然科学基金资助项目(BK2005009)~~
关键词
入侵防护
入侵检测
安全审计
单类分类器
写相关支持向量描述
intrusion prevention
intrusion detection
security audit
one-class classifier
write-related support vector datadescription
