基于粗糙集理论的安全考试系统*

为了进一步提高结合了传统静态安全技术和动态安全技术的计算机考试系统的安全性，提出了一种基于粗糙集理论的静态安全技术与动态安全技术相结合的高效低负荷的防御方法，用于监控进程的非正常行为。该方法从进程正常运行情况下产生的系统调用序列中提取出一个简单的预测规则模型，能有效地检测出进程的异常运行状态。同原有系统相比，用粗糙集理论建立正常模型要求的训练数据获取简单，而且得到的模型更适用于在线检测。实验结果表明，该系统的安全性优于原考试系统。

Secure examination system based on rough set theory

Applied the traditional information secure technology and the rough set theory to the computer examination system in order to improve the system security.This paper proposed an effective method based on rough set theory which had low overhead and high efficiency,and used to monitor the abnormal behavior of processes.It extracted a set of detection rules with minimum size to form a normal behavior model from the record of system call sequences and could detect the abnormal operating status of a process.Compa...