一种基于资源操作域的主机防护模型

论文提出了一种基于资源操作域的主机防护模型,该模型抛开了基于网络攻击数据特征码匹配构建主机防护系统的传统思路,从系统资源入手,立足于控制进程行为,力求建立一个授权访问系统资源的进程以及操作方法的最小集合。讨论了该模型的构建和运用方法,包括:通过采样、学习和修正这一反复过程构建目标系统的资源操作域;设置防护检查点、截获系统调用、基于资源操作域的检索和匹配等操作进行行为合法性验证。最后,对该模型进行了性能分析。

A Model for Protecting Host Based on Resource Operation Domain

In this paper,a model is proposed for protecting host based on Resource Operation Domain.The model discards the traditional thought,which using pattern matching for protecting host based on network attack data.At beginning of system resource,control the process behaviors and construct the least set of authorized system processes and processes operated method for special system resource.Construction and using of the model are discussed thoroughly. The ROD of special system is constructed through an iterated process of sampling,learning and modifying.Setting the protected check point,capturing the special system call,searching and matching the ROD validate the system behaviors. At last,performance of the model is analyzed.