关于场景挖掘的软件行为可信评价模型.pdfVIP

摘 要 摘 要 近年来计算机终端和网络的安全事件频发，病毒、木马、蠕虫以及利用漏洞的攻击 手段层出不穷，确保计算机软件和信息安全成为迫在眉睫的任务。目前可信计算机只能 确保计算机系统启动阶段的安全，却难以保证启动后操作系统和应用软件运行时的安全 可信。如果软件运行过程中的动态可信问题不能解决，那么可信计算机底层的可信机制 TPM（可信计算机模块）则形同虚设。通过分析各种安全威胁可发现：恶意操作或攻击 等都要通过改变系统或软件运行时的正常行为来实现其目的，所以基于软件行为的动态 可信评价技术成为研究重点。 当前软件行为检测模型大多集中在其运行路径的完整性检测上，而对软件运行过程 中各阶段功能实现的完整性缺乏检测。因此，本文提出了一种基于场景挖掘的软件行为 可信评价模型。该模型通过引入场景这一概念来描述软件运行路径上各阶段功能实现的 完整性，并结合数据挖掘领域中关联规则和序列模式算法，从已知的场景信息集合中提 取潜藏的有价值的关联信息用于软件行为可信检测。实验表明本模型具有良好的检测性 能。 关键词 软件行为 场景 数据挖掘 关联规则 序列模式 I Abstract Abstract Computer terminals and network security incidents take place with frequent in recent years. Viruses, trojans, worms and the vulnerability of software emerge in endlessly. Ensuring the security of software and information in the computer has become an urgent task. At present, trusted computer system can ensure the security of the computer systems start-up phase.When the operating system and software application on run-time after start ,it is difficult to guarantee the security. If the dynamic credibility problems in the running process can not be solved, the TPM’s (Trusted Platform Module) trusted mechanisms at the bottom of the credible computer is useless. By analyzing a variety of security threats, we can know that malicious operations or attacks achieve their aims by changing the normal behavior of the system or software running. So, the dynamic credibility detection technology base on software behavior becomes the focus of the research. Most of the current detection models for software behavior focus on the integrity detecting of its runnin