基于Q-学习算法的异常检测模型

Anomaly Detection Model Based on Q- Learning Algorithm

针对网络入侵的不确定性导致异常检测系统误报率较高的不足,提出一种基于Q-学习算法的异常检测模型(QLADM)。该模型把Q-学习、行为意图跟踪和入侵预测结合起来,可获得未知入侵行为的检测和响应。通过感知环境状况、选择适当行为并从环境中获得不确定奖赏值,有效地判断动态系统的入侵行为和降低误报率。给出了该模型框架和各模块的功能描述,经实验验证该模型是有效的。

To the problems higher rate of false retrieval in anomaly detection system due to the uncertainty of intrusion, this paper presents an Anomaly Detection Model Based on Q-Learning Algorithm （QLADM）. Combined with Q-learning, action tracing and intrusion forecasting, this model is applied to detect and response to the unknown intrusion. Through sensing environmental information, choosing adaptive action and obtaining undetermined reward from environment, the intrusive behavior is effectively distinguished and false retrieval is reduced in the dynamic system. Framework of this model and function of each sub chunk is given. The affectivity of this model is proved with emulative experiment.