Method, system, device and storage medium for system call behavior sequence dimensionality reduction

Abstract

The invention discloses a system call behavior sequence dimensionality reduction method, system, device and storage medium. The method includes: capturing the current system call behavior pattern of a specific program in real time to obtain the parameters corresponding to the system call behavior pattern per unit time ; Obtain a set of system call behavior sequences with a preset length within a preset time, and define the system call behavior sequence as a unit sequence; train the unit sequence through the system call behavior sequence self-encoding model, and train the unit sequence through the encoder The final unit sequence is subjected to dimensionality reduction processing, and a dimensionality reduction sequence of system call behavior characteristics of preset dimensions is obtained. The present invention automatically extracts the sequence features that can represent the normal call behavior of the system to effectively reduce the dimension of the system call sequence, which can not only improve the accuracy and calculation speed of subsequent abnormal detection, but also effectively implement it in embedded systems or chips. real-time processing.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a system call behavior sequence dimensionality reduction method, system, device and storage medium. Background technique [0002] At present, most of the defense methods for abnormal system call intrusion detection products on the market can only detect network attack behaviors that have been clearly analyzed and understood by artificially defining rule bases, while some methods are transformed or targeted at existing Attacks with minor modifications often become one of the weaknesses of abnormal system call intrusion detection, let alone for unknown attacks, such detection methods are even more powerless. [0003] Another artificial intelligence-based abnormal system call intrusion detection product uses One Class SVM (abnormality detection) as the main body to automatically summarize the behavior patterns of normal users or normal programs. considered an intrusion. ...

AI Technical Summary

Problems solved by technology

[0004] However, with the advent of the era of big data and artificial intelligence, using One Class SVM to effectively summarize the behavior patterns of normal users or normal programs will become more and more difficult in the implementation of embedded systems or chips. The main reason is that the system The dimension of the call sequence will become larger and larger with the development of artificial intelligence-assisted attack methods and big data, and SVM is O( ) algorithm, that is, the calculation time complexity, will show a square relationship with the dimension of the system call sequence. Excessively large system call sequence dimensions are extremely unfavorable for real-time processing of embedded systems or chips with low computing power.

Images