基于动作相关度的软件行为检测方法.pdfVIP

小型微型计算机系统 2014 年 1 月第1 期 Journal of Chinese Computer Systems Vo l. 35 No. 1 2014 基于动作相关度的软件行为检测方法 申利民，吕美远，马川，王涛，孙继浩 (燕山大学信息科学与工程学院，河北秦皇岛Q66(汩的 (河北省计算机虚拟技术与系统集成重点实验室，河北秦皇岛创6∞4) E-mail:lmy_ab@163.com 摘 要:软件行为是在一定上下文环境中，由一系列的动作组成的.因此可以通过检测动作序列推测行为是否有害.为了能够 准确推测和判断软件行为的安全性和可靠性，提出一种基于动作相关度的行为检测方法.从消息和系统调用角度提取行为特 征，根据动作的参数及其执行的上下文环境计算动作参数相关度和上下文相关度，最终计算出动作相关度.动作相关度能够衡 量动作之间关联程度，利用动作相关度查找与其相关联的其它动作，把相关联的动作序列组成同一行为与规则库中规则进行对 比判定.实验结果表明:利用该方法能够准确描述动作流程，区分出不同的行为，提高了检测的准确性，具有良好的检测性能. 关键词:行为检测;动作相关度;系统调用;入侵检测;软件行为 文章编号:1制-1220(2014)01咽34峭 中图分类号:T自11 文献标识码:A Software Behavior Detection Method Based on Action Relevance SHEN Li-min ,LV Mei-归血，MA Chuan ,W ANG Tao , SUN Ji-hao ( College of Information Science and Engin田ring ,Yanshan University ,Qinhuang缸。 066∞4 ， αùna) ( Key Laboratory for Computer Virtual Technology and System Integr捕。n ofHebei 阶ovince ，Qi曲uangdao066∞4 ， αtina) Abs衍act:So食W缸e beha悦。r is consisted of a set of actions in a c缸tain ∞ntext. Therefore , whetl阳the so负W缸e behavior is har回函.ù can be conjectured by detecting action sequenω. To acc田ately conjecωre and judge so食ware behavior s safety and reliability , an action rele- vance based behavior de悦tion method is proposed in 也is paper. Behavior features 缸百 回国cted 企om the message and sys能mcall 萨F spective and action p缸缸neter relevance and context relevance are calα血也dac∞，rding to 由e actIon p缸缸neter and its context 归功ron­ ment. Finally , action relevance is calculated from 由e 油ove results. Action relevance can be used to measure the correlation degree be- tween actions. By utilizing action relevance to se缸ch c创relative 缸tions ，也e correlative action s呵uence can be integrated into the same behavior to comp缸e and to judge with 也e rules in the rule base. Extensive experiment results