Abstract:

A new intrusion detection scheme based on the combination of the order and frequency characters of system calls (COFIDS) is proposed. This paper applies a text category algorithm (k-Nearest Neighbor Classifier, kNN) to the proposed intrusion detection scheme. In order to improve the intrusion detection rate, a similarity enhancement factor (SEF) is also presented. The preliminary experimental results demonstrate that the proposed COFIDS can provide obvious improvement in intrusion detection ability. The experiments with COFIDS also show that the proposed scheme has higher ability against to noise in the training data and to intrusion detection false positive rate.

Key words: Intrusion detection, System call, kNN algorithm

摘要： 提出了一种将系统调用的顺序特性和频度特性相接合来构建入侵检测模型（COFIDS模型）的新方法，该模型采用kNN(k-Nearest Neighbor Classifier)算法实现入侵检测，并利用一种改进的相似因子，来增加系统调用序列间相似度的差别，减少了识别误差，提高了检测率，降低了入侵检测的误报率。实验表明，COFIDS还具有较强的抗噪声干扰的能力。抗噪声干扰的能力。

关键词: 入侵检测, 系统调用, kNN算法

CLC Number: 

• TP 393