针对软件动态可信性度量方法和理论研究中存在的问题,提出以行为轨迹和检查点场景来刻画软件行为的动态特性,通过计算系统调用上下文值以及构造系统调用参数关系约束规则来评测行为轨迹和检查点场景的偏离程度,构建了基于软件行为自动机的动态可信评测模型.实验结果表明,本模型能够准确获取软件行为信息,正确检测出攻击行为,且系统开销较低.
In order to improve current dynamic trusted evaluation theories and methods of software, the conceptions of behavior trace and checkpoint scene are proposed to depict the dynamic characteristics of software behaviors, the deviation degrees of behavior trace and checkpoint scene are measured by computing system call context values and formulating relationship constraint rules of system call arguments, and a dynamic trusted evaluation model is built based on software behavior automaton. Experimental results show that this novel model can accurately obtain information on software behavior and correctly detect attacks with lower overhead.