权益分类	功能权益	普通用户	{{item.name}}会员
{{category.name}}	{{benefitItem.name}}

Development of abnormality detection system focused on a dangerous system calls using the SVM.

使用SVM开发针对危险系统调用的异常检测系统。

基本信息

批准号：
23500106
负责人：
IHA Yasushi
金额：
$ 3万
依托单位：
Okinawa National College of Technology
依托单位国家：
日本
项目类别：
Grant-in-Aid for Scientific Research (C)
财政年份：
2011
资助国家：
日本
起止时间：
2011 至 2013
项目状态：
已结题

项目摘要

In this study, we propose the anomaly detection method of combining behavior of program and detection rule to detect a dangerous system call that affects important resource of Windows system. The proposed method first detects a doubtful system call by the detection rule using system call and argument. Then, a dangerous system call is identified by using Support Vector Machine from the history of the system call, and execution is intercepted. We performed an experiment by developing the prototype system based on the proposed method, and using realistic malicious program and usual program. Through the experiments, we have evaluated the detection rate of the proposed technique and the ratio of false positive.

本文提出了一种结合程序行为和检测规则的异常检测方法，用于检测影响Windows系统重要资源的危险系统调用。该方法首先利用系统调用和参数的检测规则来检测可疑系统调用。然后，利用支持向量机从系统调用历史中识别出危险的系统调用，并拦截其执行。基于该方法开发了原型系统，并使用真实的恶意程序和常用程序进行了实验。通过实验，我们评估了所提出的技术的检测率和误报率。