系统调用序列分类的Motif方法及其在异常诊断中的应用

系统调用序列分析应用于异常诊断时大都提取定长或变长的子序列作为系统行为的特征,没有考虑系统调用的语义,而某些系统调用的语义是与进程的功能相关的.本文利用特殊系统调用的语义,从系统调用序列中提取motif-同类序列中经常出现的并与一定功能相关的子序列作为特征,并用这些motif建立分类器对序列进行自动分类.将此方法应用到PC机的入侵检测和系统故障诊断,结果表明,以motif为特征对序列进行分类,不仅可以提高识别率,降低误警报率,而且可以明显降低特征空间的维数.

System Call Sequence Classification for Anomaly Diagnosis Using Motif Method

System call sequences have been widely used for anomaly diagnosis.Traditional methods rely on fixed-length or variable-length patterns of the system calls to model program behavior.However,these techniques are all based on the mathematical rules,and do not consider the semantics of the events which might indicate the boundaries of program subtasks.This paper presents a novel approach to use system call semantics to extract the motif as the characterization of program behavior.A motif is an estimated paragra...