| 本文已被：浏览 4720次 下载 6145次 |
码上扫一扫！ |
|
|
| 一种基于控制流的程序行为扩展模型 |
|
陆炜1,2, 曾庆凯1,2
|
|
1.南京大学,计算机软件新技术国家重点实验室,江苏,南京,210093;2.南京大学,计算机科学与技术系,江苏,南京,210093
|
|
| 摘要: |
| 提出一种基于控制流的程序行为扩展模型EMPDA(extended model based on push down automaton).对控制流模型加入不变性约束扩展,该模型能够表达程序正常运行时所应保持的不变性质约束,增强了模型的监控能力;通过以实际应用区分系统调用重要性,将模型划分为核心模型和辅助模型,以降低模型整体消耗,提高模型学习效率.实验结果表明,该扩展模型较之原模型有更好的覆盖速度、误报率以及检测能力. |
| 关键词: 程序行为模型 异常检测 控制流 不变性约束 系统调用 |
| DOI： |
| 分类号: |
| 基金项目:Supported by the National Natural Science Foundation of China under Grant Nos.60473053, 60773170 (国家自然科学基金); the National High-Tech Research and Development Plan of China under Grant Nos.2004AA147070, 2006AA01Z432 (国家高技术研究发展计划(863)); the Natural Science Foundation of Jiangsu Province of China under Grant No.BK2005074 (江苏省自然科学基金) |
|
| A Control Flow Based Program Behavior Extended Model |
|
LU Wei,ZENG Qing-Kai
|
| Abstract: |
| This paper presents a control-flow-based program behavior extended model EMPDA(extended model based on push down automaton)by adding invariance constraints to control flow model,which can describe some invariance properties while a program is running safely,and enhance the ability of intrusion detection.By distinguishing the importance of system calls according to practical applications,this paper divides the program behavior model into core model and secondary model to reduce the workload of the model and improve the learning efficiency.Experimental results show that the extended model has better performances in many aspects,such as coverage speed,false positive rate and the capability of intrusion detection. |
| Key words: program behavior model anomaly detection control flow invariance constraint system call |
