一种基于图的异常入侵检测新算法

根据主机系统异常入侵过程中Windows native API序列的瞬时高频性，提出一种基于图的异常入侵检测算法。该算法首先将每个Native API映射成为图中的一个点，并以其为起点的子序列作为该点的路径、Native API的前后调用关系为边；其次，对图中每个点记录各自的路径，在这些点的路径中找到若干个圈，圈定义为因对同一个Native API重复调用而在图中出现的回路；然后，对组成圈的所有边权值根据一定规则更新；最后利用图的边与其邻边权值差计算出异常指数，判断该序列是否异常。实验结果表明该算法在Windows平台下能实时有效地检测出异常入侵和病毒的Native API序列。

Novel Intrusion Detection Algorithm Based on Graph

Because of the high instantaneous frequency of the intrusion windows native API sequence,a novel method based on graph theory was proposed to solve the problem of the host-based intrusion detection.In our algorithm,each native API is considered as a node in the graph and the transfer of two native API is the edge between these two nodes.The route for a node is defined as the subsequence beginning from itself.The repetition of the same native API in the graph is referred to as a loop.The route of each node i...