发明名称 |
System and methods for detecting intrusions in a computer system by monitoring operating system registry accesses |
摘要 |
A method for detecting intrusions in the operation of a computer system is disclosed which comprises gathering features from records of normal processes that access the files system of the computer, such as the Windows registry, and generating a probabilistic model of normal computer system usage based on occurrences of said features. The features of a record of a process that accesses the Windows registry are analyzed to determine whether said access to the Windows registry is an anomaly. A system is disclosed, comprising a registry auditing module configured to gather records regarding processes that access the Windows registry; a model generator configured to generate a probabilistic model of normal computer system usage based on records of a plurality of processes that access the Windows registry and that are indicative of normal computer system usage; and a model comparator configured to determine whether the access of the Windows registry is an anomaly.
|
申请公布号 |
US2009083855(A1) |
申请公布日期 |
2009.03.26 |
申请号 |
US20080154405 |
申请日期 |
2008.05.21 |
申请人 |
APAP FRANK;HONIG ANDREW;SHLOMO HERSHKOP;ESKIN ELEAZAR;STOLFO SALVATORE J |
发明人 |
APAP FRANK;HONIG ANDREW;SHLOMO HERSHKOP;ESKIN ELEAZAR;STOLFO SALVATORE J. |
分类号 |
G06F21/22;G06F11/30 |
主分类号 |
G06F21/22 |
代理机构 |
|
代理人 |
|
主权项 |
|
地址 |
|