- 學位論文
以函式的引數比例為基礎建置入侵偵測系統
Implementing Intrusion Detection System By Parameters Proportion of API function
摘要
摘 要 由於個人電腦,筆記型電腦的大量生產,價格普通化,多數人 都擁有電腦,加上網路硬體建設快速化,便利了人們的生活，上網路 成為人們生活中的一部分.在使用日趨普及之際，無數的病毒及後 門程式暗中流竄，到處入侵,讓使用者多了安全上的顧慮.在資訊安 全上,為了減少主機受到入侵的傷害,各式各樣的入侵偵測系統因應而生.其中,主機型入侵偵測系統利用紀錄主機端的系統日誌檔，進 而分析目前有無遭到入侵，以採取適當因應措施。 在本篇文章中,我們利用監控程式蒐集程式執行時產生的日誌 檔,從中過濾出所有程式執行時會共同使用到的API(系統呼叫),觀 察該呼叫所引用的參數,做一深入比較,得到一些平均數值 在本文後半段將利用統計的觀點來分析經由實驗所得到的這些數 值,驗證其準確性,作為判斷程式為正常或異常的判斷標準,這些數值是否具有準確性,可靠性.
並列摘要
Abstract Most of people in the world make use of the computer to communicate with other through rapid networking . Modern computer systems are plagued by security vulnerability. Whether it is the latest UNIX buffer overflow or bug in Microsoft Internet Explorer,our application and operating system are full of security flaws on many levels. We can incrementally improve secutity through the use of tools such as Intrusion Detection System(IDS).The IDS approach to secutity is based on the assumption that a system will not be secure,but that violations of security policy can be detected by monitoring and analying system behavior In this article,we will collect the log files from any program monitored by monitor module, filtering and comparing the commonly used API,observing the parameter called by the API Finally,We get some mean values and verify these values by statistics to see whether it can be available to be a justice standard base or not.