基于LSM的程序行为控制研究

张衡; 卞洪流; 吴礼发; 张毓森; 崔明伟; 曾庆凯

引用本文:	张衡,卞洪流,吴礼发,张毓森,崔明伟,曾庆凯.基于LSM的程序行为控制研究.软件学报,2005,16(6):1151-1158

【打印本页】【下载PDF全文】【查看/发表评论】【EndNote】【RefMan】【BibTex】

←前一篇|后一篇→

过刊浏览高级检索

本文已被：浏览 4835次下载 7028次	码上扫一扫！
分享到：微信更多字体:加大+\|默认\|缩小-
基于LSM的程序行为控制研究
张衡¹, 卞洪流¹, 吴礼发², 张毓森², 崔明伟¹, 曾庆凯³
1.解放军理工大学,通信工程学院,江苏,南京,210007;2.解放军理工大学,指挥自动化学院,江苏,南京,210007;3.南京大学,计算机科学与技术系,江苏,南京,210093

摘要:

程序行为控制作为一种主动检测机制,主要在4个方面进行研究:审计数据源选择、行为描述、正常行为模式的建立与行为匹配.对事件序列模型作了深入研究,提出了采用另外一种与系统调用完全不同的数据源--LSM(Linux securyty modules,简称Linux安全模块)截获点,并从理论和实践两个方面来验证LSM数据源的有效性,即基于信息理论的数据质量分析和实际系统的运行结果分析.结果表明,由于LSM数据源的粒度更细以及和安全更相关,使得它更适合作为事件序列模型的审计事件.

关键词: 程序行为控制短序列模型 Linux安全模块(LSM)

DOI：

分类号:

基金项目:Supported by the National High-Tech Research and Development Plan of China under Grant No.2002AAl41090(国家高技术研究发展计划(863))

Study on Program Behavior Control Based on LSM

ZHANG Heng,BIAN Hong-Liu,WU Li-Fa,ZHANG Yu-Sen,CUI Ming-Wei,ZENG Qing-Kai

Abstract:

Program behavior control is an active detection mechanism. The research of program behavior contro mainly focuses on four aspects: audit data selection, behavior description, the establishment of normal behavior and behavior matching. This paper investigates the event sequence model and proposes the use of LSM(Linux security modules) as an alternative data source to system calls. Based on the data quality analysis and execution results from real systems, the efficiency of the LSM data source is verified from both theoretical and practical points of view Results show that, because of its more refined granularity and its better security relevance, LSM data source is more suitable for the audit events used in event sequence models.

Key words: program behavior control model of short sequence LSM(Linux security modules)