基于系统调用序列的入侵检测模型

提出了一种基于系统调用序列的入侵检测模型，利用绝对安全环境下的应用程序系统调用序列建立正常行为模式。当发现实际系统调用序列模式与正常的行为模式不匹配时，标记为人侵，并采取应急措施。一个例程管理一个进程，给出了模式的适应度计算方法以及两个生成下一代模式的算子。实验结果表明：入侵检测模型与现有的一些模型相比，具有更好的准确性和更高的效率。

An Intrusion Detection Model Based on System Call Sequences

In this paper an intrusion detection model based on system call sequences is proposed, and a normal activity mode of the system call sequences in absolute security environment is established. If the model finds the real system call sequences mode of the process does not match the normal activity mode, it will flag the process as intrusion and take some actions to respond to it. One instance of the model monitors one process. And a new method of calculating the fitness and two operators to generate the next offspring are provided. The experimental results demonstrate that compared with some of the current models, the model presented in this paper is more veracious and more efficient.