用改进的权值树进行入侵检测

提出了一种使用系统调用序列检测入侵的新算法。算法对权值树作了一定的改进,首先使用正常序列生成权值树森林,随后对权值树作了基于海明距离的剪枝,保留了主要的正常序列。在检测过程中扫描异常调用序列,通过权值树得到对应的权值序列,同时注意了经验的利用和更新。使用这种结构不仅可以检测是否出现异常,而且能满足实时性的要求。实验取得了理想的结果。

Intrusion Detection Using the Improved Weight Tree

An improved method for anomaly intrusion detection is brought forward in this paper. The data structure is the weight tree improved based on hamming distance. Firstly, build the normal weight tree forest using normal system calls trace. Secondly, prune off some branches based on hamming distance, and the frequent sequences of system calls remain. During intrusion detecting, scan abnormal trace using the normal weight tree and get corresponding weight sequence, on which make decision whether it is abnormal or not. At the same time pay attention to making good use of experience and updating experience. The method not only can detect intrusion but also can work in real live network environment.