论文部分内容阅读
为有效防范计算机系统安全威胁,提高入侵检测的准确率。可以利用数据挖掘技术,在应用程序的系统调用数据集上进行分类挖掘,从而生成计算机免疫系统中的入侵检测规则,对未知操作进行入侵检测。本文受计算机免疫原理启发,将系统调用序列作为数据源,在对系统调用进行采集的基础上,利用C4.5算法提取规则,比较样本数据集与未知数据集来检验入侵行为,并验证了这种异常入侵检测方法的有效性和可行性。
In order to effectively prevent computer system security threats, improve the accuracy of intrusion detection. Data mining techniques can be used to classify and mine the system call datasets of an application to generate intrusion detection rules in the computer immune system and invade the unknown operations. In this paper, inspired by the principle of computerimmunization, the sequence of system calls is taken as the data source. Based on the collection of system calls, C4.5 algorithm is used to extract the rules, compare the sample dataset and the unknown dataset to verify the intrusion behavior, and verify this Effectiveness and Feasibility of the Method of Abnormal Intrusion Detection.