Research On Trust-based Judgment Method Of Entity Behavior

Mission critical system is closely related to the people’s livelihood, infrastructure services and the other critical areas of our nation. The existing detection systems treated the uncertainty behaviors and the suspicious behaviors negatively, which result in they have a high detection false negative ratio and difficult to meet the requirement. In the open environment, in order to improve the security and survivability of mission critical systems, by combined the trust mechanism and the behavior judgment, a trust-based judgment method of entity behavior was proposed. The method was oriented towards Windows systems, it has conducted on trust management for entity behaviors and established the content of the trust evidence, and it also gave the representation and storage methods of trust. Furthermore, a trust evaluation algorithm based on multidimensional factors was proposed, and the entity behavior judgment method could surely improve the accuracy of behavior detection system effectively has shown by the simulation experiments.Firstly, the situation of the existing mission critical systems was introduced, the concept and the classification of the intrusion detection technology were summarized, and the disadvantages of the existing detection mechanism were enumerated. The definition and property of trust and some mature trust management methods in network environment were considered, which provided a strong support theoretical for the trust management for behaviors in the host environment. In addition, the technical feasibility of the combination of trust mechanism and behavior judgment has been analyzed.Secondly, the overall design framework of the trust-based judgment method of entity behavior was given, each module’s coupling structure of the method was defined. The framework based on the behavior’s features of the host environment, the content of trust evidence and the evidence collection mechanism were established, the discrete trust representation method and the quantitative basis of trust evidences was depicted in detail. According to the Eigen Trust algorithm and the thought of Peer Trust algorithm, a trust evaluation algorithm based on multidimensional factors was proposed, the contradiction between the host resource occupancy and the efficiency of trust evaluation was alleviated. And the unified external interface mode of the behavior judgment method was given.Thirdly, some implementation requirements of the trust-based judgment method of entity behavior have been put forward. According to the requirements, the specific implementation mechanism of each module of the method faced to Windows environment has been given. The evidence collection methods of trust were analyzed, the data structure of the trust store was designed, the trust evaluation algorithm based on multidimensional factors was implemented, and the believable threshold of the method was established through the experiment.Finally, through the simulation experiment, the detection veracity rate of the behavior detection system which has used the judgment method and the one has unused the method have been contrasted, the effectiveness of the method for the behavior detection system was illustrated, and the possibility of the combination of trust and behavior detection field was showed.