Process monitoring on sequences of system call count vectors
Process monitoring on sequences of system call count vectors
复制标题
对系统调用计数向量序列的进程监控
DOI：
10.1109/ccst.2017.8167792
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
David Tolpin
中科院分区：
文献类型：
--
作者：
M. Dymshits;Benjamin Myara;David Tolpin
我们介绍了一种方法，有效地监控企业网络中的主机上运行的进程。该方法基于收集由主机上的所有或选定进程产生的系统调用流，并通过网络将它们发送到监控服务器，在监控服务器中，机器学习算法用于识别由于恶意活动、硬件故障或软件错误而导致的进程行为的变化。该方法使用一系列系统调用计数向量作为数据格式，可以处理大量和变化的数据。与以前的方法不同，本文介绍的方法适用于大型企业网络中的分布式数据收集和处理。我们在实验室环境中对该方法进行了评估，并提供了表征该方法性能和准确性的统计数据。
We introduce a methodology for efficient monitoring of processes running on hosts in a corporate network. The methodology is based on collecting streams of system calls produced by all or selected processes on the hosts, and sending them over the network to a monitoring server, where machine learning algorithms are used to identify changes in process behavior due to malicious activity, hardware failures, or software errors. The methodology uses a sequence of system call count vectors as the data format which can handle large and varying volumes of data. Unlike previous approaches, the methodology introduced in this paper is suitable for distributed collection and processing of data in large corporate networks. We evaluate the methodology both in a laboratory setting on a real-life setup and provide statistics characterizing performance and accuracy of the methodology.