網路安全問題每年造成的達數十億美元損失。隨著網際網路的興起，我們所使用的電腦軟體也充斥著安全漏洞，電腦系統的安全議題也在此環境中變的越來越重要。儘管『緩衝區溢位』(Buffer Overflows)的軟體漏洞已經被發現多年，現今的電腦系統仍然持續的受到這類型的攻擊。 本篇論文提出一個改良過的入侵偵測系統(Intrusion Detection System)，利用以函數為基礎的系統呼叫序列(Function-based Sequences of System Call)來偵測程式的異常行為(Abnormal Behavior)。這個方法尤其對『緩衝區溢位攻擊』特別有效。除此之外，我們還使用了一種名為『字尾樹』(Suffix Tree)的資料結構來改善偵測的效率。實驗結果顯示我們的方法不管是在攻擊的阻擋率或者是效能上都比改善前的方法好。 Computer and network security problems cause billions in damage every year. As the use of Internet, modern computer systems are plagued from security vulnerabilities. Security issues have become more and more important in such environment. Although the concept of buffer overflows had been known for years, modern computer systems suffered from these kinds of security weaknesses constantly. This article presents an improved method for intrusion detection, which detect abnormal behaviors of a process using function-based sequences of system calls. The method is especially effective in detecting Buffer Overflow Attacks. Our method also stored these sequences through a data structure called Suffix Tree, which improved our system performance a lot. Experiments show that our method has better effectiveness and performance than previous methods.
