Abstract:Industrial control terminals play an important role in industrial control scenarios. Due to the special nature of industrial control networks, industrial control terminal systems are vulnerable to malicious attacks, which can greatly threaten the stability and security of industrial production environments. Traditional security protection methods for industrial control terminals have coarse detection granularity, and are unable to effectively detect and prevent attacks, lacking real-time responsiveness to attack events. Therefore, this paper proposes a real-time dynamic credibility evaluation mechanism based on program behavior, which integrates the matching and symmetry ideas of credibility evaluation. By conducting a real-time dynamic credibility evaluation of function call sequences and system call sequences during program execution, the credibility of industrial control terminal application program behavior can be judged. To solve the problem that the system calls generated during program execution are unstable and difficult to measure, this paper proposes a partition-based dynamic credibility evaluation method, dividing program behavior during runtime into function call behavior and system call behavior within function intervals. For function call behavior, a sliding window-based function call sequence benchmark library construction method is proposed, which matches and evaluates real-time measurement results based on the benchmark library, thereby achieving symmetry between the benchmark library and the measured data. For system call behavior, a maximum entropy system call model is constructed, which is used to evaluate the credibility of system call sequences. Experiment results demonstrate that our method performs better in both detection success rate and detection speed compared to the existing methods.

A New Study of the System Call Sequence Analysis Method

An Intrusion Detection System Based On System Call

A Markov Model of System Calls Sequence and Its Application in Anomaly Detection

Research on Improved Intrusion Detection System in Mobile Ad hoc Network

Research on Covert Channel Analysis in Tuling SecOS2.0/4

Back-propagation Neural Network on Markov Chains from System Call Sequences: a New Approach for Detecting Android Malware with System Call Sequences.

Predicting the Intrusion Intentions by Observing System Call Sequences

A Low-Cost Method to Intrusion Detection System Using Sequences of System Calls

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

Risk-Based System-Call Sequence Grouping Method for Malware Intrusion Detection

Anomaly Detection Based on System Call Classification

Modeling program behaviors by hidden Markov models for intrusion detection

Plan Recognition Based Method for Predicting Intrusion Intentions of System Call Sequences

An Implementation of Windows System Call Interception Used For Access Control

Study on Abnormal Detection Based on System Call and Data Mining Technique

Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data

Program Behavior Dynamic Trust Measurement and Evaluation Based on Data Analysis

An Intrusion Detection System for Network Storage Based on System Calls

Intrusion Techniques: Comparative Study of Network Intrusion Detection Systems

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

Research and application of internal malicious code threat detection system