基于构造性核覆盖算法异常入侵检测.pdfVIP

第5 期 电 子 学 报 VoI. 35 No. 5 2007 年5 月 ACTA ELECTRONICA SINICA May 2007 基于构造性核覆盖算法的异常入侵检测 周鸣争，楚 宁，强 俊 （安徽工程科技学院计算机科学与工程系，安徽芜湖24 1000 ） 摘 要： 将构造性核覆盖算法引入入侵检测研究中，提出了一种基于构造性核覆盖的异常入侵检测算法， 用于监控进程的非正常行为. 首先分析了核覆盖分类算法应用于入侵检测的可能性，然后具体描述了核覆盖算 法在异构数据集下的推广，提出了基于核覆盖的异常入侵检测模型. 并以sendmaiI 系统调用序列数据集为例，详 细讨论了该模型的工作过程. 最后将实验仿真结果与其它方法进行了比较，结果表明，该方法的检测效果优于同 类的其它方法. 关键词： 异常入侵检测；核覆盖；异构数据集；系统调用 中图分类号： TP309 文献标识码： A 文章编号： 0372-2112 （2007 ）05-0862-06 An Anomaly lntrusion Detection Based on Constructive Kernel Covering Algorithm ZHOU Ming-zheng ，CHU Ning ，OIANG Jun （Dep artment of Comp uter Science and Engineering ，Anhui Uniuersity of Technology and Science ，Wuhu ，Anhui 24 1000 ，China ） Abstract ： Constructive Kernel Covering Algorithm is inducted into intrusion detection and an anomaly intrusion de- tection. This method based on Constructive Kernel Covering Algorithm is proposed which applied to monitoring the abnormal behavior of processes. Firstly ，this paper analyzes the possibility of Kernel Covering Algorithm applied to intrusion detection ； Secondly ，the Kernel Covering Algorithm generalized on heterogeneous datasets is described ，and a model of anomaly intru- sion detection based on Kernel Covering Algorithm is proposed. Then we illustrate the sendmail system call seguence dataset and discuss the working process of this model in detail ；Finally ，the emulation result is compared with other methods. The re- sult indicates that this method is superi