【作者】 李婷；

【导师】 贾小珠；

【作者基本信息】 青岛大学 ， 计算机软件与理论， 2004， 硕士

【摘要】 入侵检测是网络高层次安全的保障系统，论文主要研究了基于程序行为的异常检测技术，目的是利用异常检测技术的高适应性和程序行为的不易变性来提高检测系统的性能。在Unix环境下构建了一个基于程序行为的异常检测模型，详细阐述了该模型的模式抽取模块、检测模块以及检测参数修正模块的设计与实现。采用基于Teiresias算法的变长模式抽取方法构建程序正常行为模式库，在模式匹配中，基于两步匹配算法实现变长模式匹配。引入了一种基于阈值的入侵判定方法，并在此基础上，针对检测参数的确定进行了相关研究，提出一种新的匹配算法用于确定阈值的取值范围。利用新墨西哥大学提供的仿真数据进行了实验测试，实验结果表明在阈值一定的前提下，通过适当的调整两步匹配算法中匹配因子D的值，可有效地降低异常检测的误报率。更多还原

【Abstract】 Intrusion detection system is a high-level defence system on network security. This paper discuss a program-based anomaly detection approach, which takes both advantage of the ability of anomaly detection in detecting novel attacks and the stability of program behavior in intrusion analysis compared with other observables. We design a program-based anomaly detection model under Unix and explicate chiefly pattern extraction module, detection module and detection parameters amending module. A variable-length patterns extracting approach based on Teiresias algorithm is adopted to model the normal program behavior, and a two-step matching algorithm is applied to implement variable-length pattern matching. We apply an intrusion decision measure based on threshold to determine if an intrusion happens. In order to select detection parameters, we put forward a new matching algorithm to choose the scope of threshold and make an experiment using the emulational data provided by the University of New Mexico. The result of the experiment indicates that false positive can be reduced effectively by adjusting suitably the value Ox matching gene, under the precondition of threshold confirmed.更多还原