基于基因规划的主机异常入侵检测模型.pdfVIP

1000-9825/2003/14(06) 1120 ©2003 Journal of Software 软 件 学 报 Vol.14, No.6 基于基因规划的主机异常入侵检测模型 + 苏璞睿 , 李德全, 冯登国 ( 中国科学院 软件研究所 信息安全国家重点实验室,北京 100800) A Host-Based Anomaly Intrusion Detection Model Based on Genetic Programming + SU Pu-Rui , LI De-Quan, FENG Deng-Guo (State Key Laboratory of Information Security, Institute of Software, The Chinese Academy of Sciences, Beijing 100080, China) + Corresponding author: Phn: 86-10ext 801, Fax 86-10 E-mail: supurui@263.net Received 2002-04-22; Accepted 2002-09-17 Su PR, Li DQ, Feng DG. A host-based anomaly intrusion detection model based on genetic programming. Journal of Software, 2003,14(6):1120~1126. /1000-9825/14/1120.htm Abstract : Anomaly Detection techniques assume all intrusive activities deviate from the norm. In this paper a new anomaly detection model is found to improve the veracity and efficiency. The proposed model inestablishes a normal activity profile of the systemcall sequences by using Genetic Programming. One instance of the model monitors one process. If the model finds the real systemcall sequences profile of the process deviating from the normal activity profile, it will flag the process as intrusive and take some actions to respond to it. And a new method of calculating the fitness and two operators to generate the next offspring are provided . According to the comparison with some of current models, the model is more veracious and more efficient. Key words : intrusion detection; genetic programming; anomaly detection 摘 要: 异常检测技术假设所有的入侵行为都会偏离正常行为模式.尝试寻找一种新的异常入侵检测模型改 善准确性和效率.模型利用应用程序的系统调用序列,通过基因规划建立了正常行为模式.模型的一个例程管理 一个进程. 当它发现进程的实际系统调用序列模式偏离正常的行为模式时,会将进程设标记为入侵,并采取应急 措施.还给出了基因规划的适应度计算方法以及两个生成下一代的基本算子.通过与现有一些模型的比较,该模 型具有更好的准确性和更高的效率. 关键词: 入侵检测;基因规划;异常检测 中图法分类号: TP3