摘要： 入侵检测是网络安全研究的热点技术之一，是新一代安全保障方案。该文实现了一种基于系统调用的异常入侵检测方法，使用系统调用作为输入，构建程序中函数的有限状态自动机，利用该自动机检测进程流程是否发生异常来确定是否发生了入侵。实验结果表明，该技术不仅能有效地检测出入侵行为，而且可以发现程序漏洞的位置，便于修改代码。

关键词: 入侵检测, 异常检测, 系统调用, 有限状态自动机

Abstract: Intrusion detection is an efficient way to protect information system. This paper explains a new anomalous intrusion detection method. It uses system calls as input, and creates a FSA for the functions in the program. Then the FSA is used to detect the attack. It finds the place where the vulnerability exists in the program. This can help alter the source program. Experiment proves the method is effective in many intrusion events.

Key words: Intrusion detection, Anomalous detection, System call, Finite-state automation machine

中图分类号: 

• TP301.6