Development of abnormality detection system focused on a dangerous system calls using the SVM.

本文提出了一种结合程序行为和检测规则的异常检测方法，用于检测影响Windows系统重要资源的危险系统调用。该方法首先利用系统调用和参数的检测规则来检测可疑系统调用。然后，利用支持向量机从系统调用历史中识别出危险的系统调用，并拦截其执行。基于该方法开发了原型系统，并使用真实的恶意程序和常用程序进行了实验。通过实验，我们评估了所提出的技术的检测率和误报率。

In this study, we propose the anomaly detection method of combining behavior of program and detection rule to detect a dangerous system call that affects important resource of Windows system. The proposed method first detects a doubtful system call by the detection rule using system call and argument. Then, a dangerous system call is identified by using Support Vector Machine from the history of the system call, and execution is intercepted. We performed an experiment by developing the prototype system based on the proposed method, and using realistic malicious program and usual program. Through the experiments, we have evaluated the detection rate of the proposed technique and the ratio of false positive.