摘要
针对目前程序动态度量研究中实时性与准确性较差的问题,提出了一种利用程序行为特征进行度量的方法。通过筛选程序运行过程中产生的系统调用,依据其关联特性构成非定长系统调用序列作为程序的行为特征;采用后缀树结构设计实时特征度量匹配算法(feature matching with updating suffix tree,FMUS),实现了程序运行过程中的实时特征匹配。实验表明,该方法具有较高的准确率和低时间耗费比。
Aiming at the problem of poor instantaneity and low accuracy in current study of dynamic measure. ment,this paper proposed a kind of measurement method using the program behavior feature. It constituted variable-length system call sequences as behavior features according to the sifting and relevance analyzing of system calls generated from running program. It devised the FMUS algorithm based on suffix tree and achieved the feature matching when program was running. Experiments on the selected samples show that this method has high accuracy and low time expending rate.
出处
《计算机应用研究》
CSCD
北大核心
2016年第4期1154-1158,共5页
Application Research of Computers
基金
国家自然科学基金资助项目(61472447)
关键词
动态度量
行为特征
非定长
系统调用序列
后缀树
dynamic measurement
behavior feature
variable length
system call sequence
suffix tree
