CAJ | 학술논문

系统调用是操作系统和用户程序的接口，任何程序必须通过系统调用才能执行。近年来，网络安全事件频发，基于系统调用序列分析的入侵检测方法成为了网络安全研究的热点技术之一。本文提出了基于枚举序列、隐马尔科夫两种方法建立系统行为的层次化模型，不同于传统意义上的单层次模型。在新墨西哥大学提供的实验数据上，本方法在检测程序异常行为的准确度和响应时间方面都得到了很好的效果，表明该方法更适合基于主机入侵的在线检测方法。
계통조용시조작계통화용호정서적접구，임하정서필수통과계통조용재능집행。근년래，망락안전사건빈발，기우계통조용서렬분석적입침검측방법성위료망락안전연구적열점기술지일。본문제출료기우매거서렬、은마이과부량충방법건립계통행위적층차화모형，불동우전통의의상적단층차모형。재신묵서가대학제공적실험수거상，본방법재검측정서이상행위적준학도화향응시간방면도득도료흔호적효과，표명해방법경괄합기우주궤입침적재선검측방법。
System calls are the interface between operating system and user programs.Execution of each program must use some system calls.In recent years,network security incidents occur frequently,intrusion detection method based on the system call sequence analysis has become one of the hot network security technology researches.This paper presents a multi-layer model of program behaviours based on both hidden Markov models and enumerating methods,which differs from the conventional single layer approach.On experimental data provided by the University of New Mexico,experimental results have shown that the model is better in detecting anomalous behaviour of programs in terms of accuracy and response time, which indicates that this method is suitable for online host -based intrusion detection systems.