基于粗糙集值约简改进算法的进程异常检测

提出一种新的基于粗糙集值约简和系统调用的进程异常检测方法。为了提高约简效率，改进了基于差别矩阵的粗糙集值约简算法。另外创建了一种新的检测模型，能在判断进程是否异常的基础上进一步识别异常种类。它以系统调用短序列中k个位置作为条件属性集，以进程类型作为决策属性，建立决策表；然后使用改进的值约简算法提取规则集，并对规则匹配的结果作统计；最后判断进程类别。实验表明该方法能高效准确地识别异常进程的种类。

Abnormal detection of processes based on improved rough set value reduction algorithm

This paper proposed a new method for abnormal detection of processes based on RS value reduction and system calls.Improved the algorithm of rough set value reduction based on discernibility matrix to increase the reduction efficiency.And built a new detection model.It could not only tell whether the process was normal or abnormal,but also identified the type of the abnormality.First,made a decision table by using the k positions in the short sequences of system calls as the conditional attributes and the ty...