摘要： 用马尔科夫链对序列数据进行分析时,其预报准确率对于序列演变的异常与否相当敏感,而Linux进程可由一系列的系统调用序列来表征。据此,该文用马尔科夫链对Linux进程的系统调用序列进行行为模式提取并作异常检测。同时,还考虑了序列的顺序关系,使得模式有了合理的解释。

关键词: 异常检测, Linux进程, 系统调用序列, 行为模式, 马尔科夫链

Abstract: A Linux process can be presented by a system call sequence, and Markov chains analysis can be used to predicate sequential data with acorrectness fairly sensitive to whether the evolution of the sequential data is in normal or not. This paper proposes to apply Markov chains analysis topattern extraction and anomaly detection of Linux system call sequences while taking account of the sequential relation of system calls in process.Experiments suggest that this gives a reasonable explanation to behavior patterns and produces good results.

中图分类号: 

• TP393.08