基于聚类的HMM算法及其在NIDS中的应用

HMM Algorithm Base on Clustering and Application in NIDS

本文提出根据正常-异常序列模式异常来定义紧急级别的新概念,将隐马尔可夫模型引入到网络入侵检测系统中检测正常-异常序列中的模式异常。并针对直接对检测数据进行HMM训练和检测,存在计算量很大的问题,提出了采用先聚类降低状态维数,然后采用HMM的方法进行NIDS检测的方法。实验证明其有效性。

In this paper, new conception of emergent level is defined by abnormal patteru in normal-abnormal serials. Hidden Markov Model is induced to detect abnormal pattern. Because computation is large when training and detecting on datum directly, clustering is induced to decrease the dimensions firstly and then HMM algorithm is used to detect the abnormal model. Results show that it is effective.