摘要
系统调用序列分析应用于异常诊断时大都提取定长或变长的子序列作为系统行为的特征,没有考虑系统调用的语义,而某些系统调用的语义是与进程的功能相关的.本文利用特殊系统调用的语义,从系统调用序列中提取motif-同类序列中经常出现的并与一定功能相关的子序列作为特征,并用这些motif建立分类器对序列进行自动分类.将此方法应用到PC机的入侵检测和系统故障诊断,结果表明,以motif为特征对序列进行分类,不仅可以提高识别率,降低误警报率,而且可以明显降低特征空间的维数.
System call sequences have been widely used for anomaly diagnosis. Traditional methods rely on fixed-length or variable-length patterns of the system calls to model program behavior. However,these techniques are all based on the mathematical rules,and do not consider the semantics of the events which might indicate the boundaries of program subtasks. This paper presents a novel approach to use system call semantics to extract the motif as the characterization of program behavior. A motif is an estimated paragraph of the system calls which might represent a program subtask. The results of two case studies on intrusion detection and root cause recognition on the personal computers demonstrate improved performance and more compact feature space over existing pattern-based methods.
出处
《小型微型计算机系统》
CSCD
北大核心
2008年第8期1445-1449,共5页
Journal of Chinese Computer Systems
基金
多媒体计算与通信教育部-微软重点实验室科研基金项目(05071809)资助
关键词
系统调用序列
模式
分类
异常检测
system call sequence
motif
classification
anomaly diagnosis
