基于网络的HMM异常检测方法研究

The Research of HMM Anomaly Detection Approach Based on Network

文章从HMM的基本思想、概念出发,建立了以捕获的网络数据包为观测对象的HMM异常检测原型。对原型中存在的可见符号集太大的问题,提出了对观测对象进行分段的改进办法,进而建立了具有可操作性的HMM异常检测模型。在观测对象的概率计算方面,引入了滑动窗口的概念,解决了概率值过小的问题。对模型的训练,给出了模型训练算法、矩阵B的更新公式。

From the basic thought and concept of HMM,the article establishes the prototype of HMM anomaly detection based on network.To resolve some problems which produced from in the large set of observed objects,the improved means that partition the observed object to some fields is proposed to the prototype,by which we establish the feasible HMM of anomalous detection based on network.The sliding window concept is introduced to solve the problem of excessively small probability values.In the model training aspect,the model training algorithm and the matrix B renewal algorithm is created.