| Intrusion detection is one of the most important techniques in protecting computer security, and so far many intrusion-detection models have been proposed. Since the hacker's behavior is completed by process calls, and a sequence of system calls gives a stable signature for a Linux process, behavior of the processes can be explored by analyzing the system call sequences; notice that Petri net can analysis both static structure and dynamic behavior. Therefore, in this thesis, Petri net description is investigated for describing system call sequences, we also discussed the relationship between process structure and program structure, according to the process structure we find the program's might structure. It helps us detecting the hacker's purpose and achieves intrusion detection.Primary experiments in this thesis suggest that this method is feasible and effective. |
