利用Windows Native API调用序列和基于决策树算法的主机异常检测*

主要研究Windows平台下的异常检测方法，提出一种利用Windows Native API调用序列和基于决策树算法的主机服务进程模式抽取算法，并通过在模式中引入通配符而大大缩减了模式集的规模。进一步引入了表征模式间关系的转移概率，建立了模式序列的全局马尔可夫链模型，并给出了相应的异常检测算法。实验结果表明：该算法可以抽取一个规模较小且泛化能力较强的模式集，相应的检测算法可以有效地检测异常。

Decision Tree Algorithm based Host Anomaly Detection Using Windows Native API Sequences

Anomaly detection algorithm for Windows platform is studied. A host process pattern extraction algorithm using Windows Native API sequences and based on decision tree is presented, and a wildcard is introduced in patterns, so the size of pattern set is reduced considerably. More over, transition probabilities between patterns are computed to build a global Markov Chain Model of pattern sequences, and related anomaly detection algorithm is presented. Experiments demonstrate that the algorithms can extract a pattern set of small size and high generalization ability, and can detect anomalies effectively.