摘要： 针对基于系统调用序列的入侵检测方法在实际应用中成本偏高的问题，在STIDE方法的基础上提出一种低耗时的入侵检测算法。利用N元语义模型分析系统调用序列规律，计算系统调用的贡献度，抽取最能体现用户正常行为的系统调用，建立正常模式库实现异常检测。实验结果证明，该算法在保证检测率不下降的同时，训练和检测系统调用短序列的规模降低70%。

关键词: 统计语言模型, 系统调用, 入侵检测

Abstract: The existing intrusion detection methods based on sequences of system calls have a large overhead to construct normal profile. An efficient algorithm using statistical language models is proposed based on STIDE in order to reduce the computing cost. The system calls which can represent the characteristics of normal behaviors are extracted by an N-gram method. The improved algorithm extracts the most relevant sequences of system calls. Experimental results demonstrate that the computing cost of the improved algorithm has a reduction of 70% than the standard one and no degradation of detecting rate and false positive rate.

Key words: statistical language models, system calls, intrusion detection

中图分类号: 

• TP309.2