摘要
提出一种基于控制流的程序行为扩展模型EMPDA(extended model based on push down automaton).对控制流模型加入不变性约束扩展,该模型能够表达程序正常运行时所应保持的不变性质约束,增强了模型的监控能力;通过以实际应用区分系统调用重要性,将模型划分为核心模型和辅助模型,以降低模型整体消耗,提高模型学习效率.实验结果表明,该扩展模型较之原模型有更好的覆盖速度、误报率以及检测能力.
This paper presents a control-flow-based program behavior extended model EMPDA （extended model based on push down automaton） by adding invariance constraints to control flow model, which can describe some invariance properties while a program is running safely, and enhance the ability of intrusion detection. By distinguishing the importance of system calls according to practical applications, this paper divides the program behavior model into core model and secondary model to reduce the workload of the model and improve the learning efficiency. Experimental results show that the extended model has better performances in many aspects, such as coverage speed, false positive rate and the capability of intrusion detection.
出处
《软件学报》
EI
CSCD
北大核心
2007年第11期2841-2850,共10页
Journal of Software
基金
Nos.60473053
60773170(国家自然科学基金)
Nos.2004AA147070
2006AA01Z432(国家高技术研究发展计划(863))
No.BK2005074(江苏省自然科学基金)~~
关键词
程序行为模型
异常检测
控制流
不变性约束
系统调用
program behavior model
anomaly detection
control flow
invariance constraint： system call
