一種基于LSM的數(shù)據(jù)源在異常檢測(cè)中的應(yīng)用

【摘要】針對(duì)異常檢測(cè)中的數(shù)據(jù)源選擇、行為描述、正常行為學(xué)習(xí)和行為匹配，提出了一種新的基于安全模塊的數(shù)據(jù)源。為驗(yàn)證其有效性，采用基于信息理論的數(shù)據(jù)分析和馬爾可夫模型兩種方法，并與目前較多采用的系統(tǒng)調(diào)用數(shù)據(jù)源作了對(duì)比。實(shí)驗(yàn)結(jié)果表明，新數(shù)據(jù)源有效，且在一定條件下，比系統(tǒng)調(diào)用數(shù)據(jù)更具優(yōu)勢(shì)。
關(guān) 鍵 詞 異常檢測(cè); 行為控制; 安全模塊; 系統(tǒng)調(diào)用

The research of anomaly detection now focuses on four aspects: selection of data source, specification of behavior, normal behavior learning, behavior matching. For the first aspect, a new data source, which is based on linux security modules, is presented in paper. In order to test its effect, we employ two kinds of method: information-theoretic measures and Markov chains model, and we also compare the result with data of system call. The conclusion of experiment indicates that this data source is useful and even better than data of system call under certain condition.