ISSN 1000-1239 CN 11-1777/TP

• 信息安全 •

### 云环境基于系统调用向量空间的进程异常检测

1. 1(四川大学网络空间安全学院 成都 610065);2(四川大学计算机学院 成都 610065) (chenxsh@scu.edu.cn)
• 出版日期: 2019-12-01
• 基金资助:
国家自然科学基金青年科学基金项目(61802270,61802271);四川省重点研发项目(2018GZ0100)；中央高校基本科研业务费专项资金(2017SCU11059)

### Process Abnormal Detection Based on System Call Vector Space in Cloud Computing Environments

Chen Xingshu1,2, Chen Jiaxin2, Jin Xin2, Ge Long2

1. 1(School of Cybersecurity, Sichuan University, Chengdu 610065);2(School of Computing, Sichuan University, Chengdu 610065)
• Online: 2019-12-01

Abstract: The intrusion detection scheme based on system call in the traditional host domain often monitors the running behavior of a single privileged process. It is difficult to effectively detect the abnormal process behavior of the virtual machine using the host intrusion detection scheme because of more security risks in the cloud computing environment. To break this limitation, a virtual machine process behavior detection model based on system call vector space is proposed. The model collects system call data of different operating system without using agent in the virtual machine. The TF-IDF (term frequency-inverse document frequency) algorithm idea is introduced to weight the process system call data to distinguish different running services in the virtual machine and identify abnormal process behavior. Furthermore, in order to optimize the efficiency of the detection algorithm, a storage strategy combining compressed sparse row (CSR) matrix and K-dimension tree is designed. Eventually a prototype system called VMPBD (virtual machine process behavior detecting) has been implemented on the platform of KVM (kernel-based virtual machine). The functions and performance of VMPBD is tested on Linux and Windows virtual machines. The results show that VMPBD can effectively detect the abnormal behavior of the virtual machine processes, and the detection false alarm rate and system performance overhead are within the acceptable range.