| Budget Amount *help |
¥4,680,000 (Direct Cost: ¥3,600,000、Indirect Cost: ¥1,080,000)
Fiscal Year 2013: ¥910,000 (Direct Cost: ¥700,000、Indirect Cost: ¥210,000)
Fiscal Year 2012: ¥910,000 (Direct Cost: ¥700,000、Indirect Cost: ¥210,000)
Fiscal Year 2011: ¥2,860,000 (Direct Cost: ¥2,200,000、Indirect Cost: ¥660,000)
|
|---|
| Research Abstract |
In this study, we propose the anomaly detection method of combining behavior of program and detection rule to detect a dangerous system call that affects important resource of Windows system. The proposed method first detects a doubtful system call by the detection rule using system call and argument. Then, a dangerous system call is identified by using Support Vector Machine from the history of the system call, and execution is intercepted. We performed an experiment by developing the prototype system based on the proposed method, and using realistic malicious program and usual program. Through the experiments, we have evaluated the detection rate of the proposed technique and the ratio of false positive.
|
