Abstract:

Under the two kinds of system operation conditions，abnormal state and normal state，indicated data on behalf of the system running status was collected by system monitoring tools such as nmon，and the obtained index data was quantitatively operated. The features of multidimensional behavior was constructed which could reflect the running state of the system. The index data has been carried on by effective feature extraction by means of the between-class and within-class distance measurement criterion，and knowledge base of behavior features was constructed which reflects the system running state. The decision tree was constructed to judge whether the system of state was secure through data features of behavior knowledge base.

Key words: knowledge base of behavior feature, between-class and within-class distance measurement criterion, decision tree