摘要
对仿生免疫系统GECISM(General Computer Immune System Model),沙盒主机是其中的一个主要代理。文章详细介绍了沙盒主机中“非我”检测与分类的结构。通过定义安全相关调用,对采集形成的安全相关调用短序列进行训练,生成序列库和规则库,从而对“非我”进行检测和分类,同时对测试程序“非我”类型的分布进行了讨论。实验证明了用此方法进行“非我”检测和分类的可行性和高效性。
Sand box is a main component of agents in GECISM.The structure of detection and classification of ＂non-self＂ in sand box is introduced in detail.The concept of system call related to security is defined, and sequence library and rule library are built by training short sequences of system call related to security.Then ＂non-self＂ can be detected and classified,and the distributing of different types of ＂non-self＂ in testing program is discussed.The experiment verifies the feasibility and effectiveness of this method.
出处
《计算机工程与应用》
CSCD
北大核心
2005年第35期129-131,182,共4页
Computer Engineering and Applications
基金
河北大学校内课题项目(编号:2003Z06)
关键词
计算机免疫系统
系统调用序列
“非我”检测
分类
分布
computer immune system,sequence of system call,＂non-self＂,detection,classification,distributing
