基于Linux系统调用的主机入侵检测系统的设计

现代计算机系统在稳定性和安全方面存在许多问题,大部分是由于异常的程序行为所导致,主机入侵检测系统能有效的检测程序异常活动.通过对Linux2.4内核的研究,以内核补丁的形式设计与实现了一个原型系统NUMEN,该系统采用前向序列对方法对系统调用序列进行分析,当检测到进程行为异常时,它将延迟该进程发起的系统调用请求,如果异常的出现是由于安全违规活动而引起的,NUMEN在破坏发生之前阻止攻击活动,确保系统的安全性.

Design of host intrusion detection system based on Linux system call

Modern computer systems are plagued with stability and security problems.Many of these problems arise from rare program behaviors.Host intrusion detection system can detect abnormal behavior effectively and a prototype named "NUMEN" is implemented as a small patch for Linux 2.4 kernels,which detects and delays anomaly in program behavior by observing changes in short sequences of system called by the lookahead pairs method.If the anomaly corresponds to a security violation,NUMEN can stop attacks before they can do damage on time,and ensure system security.