主机违规行为是能对主机及其所在信息系统的安全造成影响,或泄露主机上的重要信息的行为。提出一种主机违规检查方法,针对主机违规行为证据信息进行单一证 据源基础概率判定,并通过D-S证据理论对其进行融合,计算得到主机行为的违规系数,以此作为违规检查的判定依据。实验表明,该方法能够满足主机违规检查 工作的应用需求,具有较低的误报率和漏检率。Host violation is a such behaviour that it either breaks the security of the host and its information system or reveals the important information on the host.In this paper,a host violation checking method is proposed,which discriminates the underlying probability of single evidence resource aiming at the evidence information of each violation of host independently,and then fuses them based on D-S evidence theory,and attains violation coefficient of the host behaviour according to calculation,that will be considered as the discrimination basis for violation checking.Experiments indicate that by using this method,the application demand in host violation checking is able to be met with lower false alarm rate and missing rate
