摘要
Markov链模型作为一种统计分析方法是异常检测的重要分析手段 ,论文分别从单步、多步Markov链和基于Markov链的序列预测三个方面 ,研究了Markov链模型在异常检测检测上的应用 .实验表明 ,该方法在不需要任何攻击领域知识的情况下 ,能很好检测出SendMail系统调用的异常行为 .
Markov chain model, as a statistical method, is an important analytical method. In this paper, Markov chain model used for anomaly detection is in discussed in depth from three aspects, one-step, multi-step Markov chain and multi-step Markov chain-based sequence prediction. The experiments show the method can detect the anomaly behavior of SendMail program without needing any system security knowledge.
基金
国家自然科学基金重大研究计划 (90 10 4 0 30 )资助项目
