针对目前进程行为评估模型所存在的模型优化问题和模型选取问题,定义进程行为,采用隐马尔可夫模型(HMM)来描述进程行为.讨论了准确率与误报率的关系,提出多维进程行为评估模型,以弥补单一进程行为评估模型的不足,基于布尔运算对多维进程行为评估模型进行融合,提高了评估性能.并基于代价决策树理论,给出了选取最优进程行为评估模型的目标函数,用于在融合后的多维进程行为评估模型上选择最优进程行为评估模型.最后,对所提出的多维进程行为评估模型的性能进行了测试,并与传统的STIDE和HMM方法进行了比较,结果证明了其有效性和优越性.%To solve the existing problems of optimization and selection in process behavior evaluation model,the process behavior was defined,and the process behavior was described based on Hidden Markov Model(HMM).The relation between precision rate and false positives rate was discussed,and a multiple-dimension process behavior evaluation model based on Boolean function was proposed,which overcame the shortcomings of single process behavior evaluation model,and increased evaluation performance.On the basis of cost decision tree,the target function was given to select the optimal process behavior on the proposed evaluation model.Finally,the proposed evaluation model was tested and compared with the traditional Sequence TIme-Delay Embedding(STIDE) and HMM method.The test results verify the efficiency and superiority of the proposed model.
展开▼
