基于系统调用的混合HMM/MLP异常检测模型

A Hybrid HMM/MLP Anomaly Detection Model Based on System Calls

首先描述了基于隐马尔可夫模型(HMM)的异常检测方法并指出其缺点.然后提出了一种将多层感知机(MLP)用作HMM的概率估计器的方法,以克服HMM方法的不足.最后建立了一个基于系统调用的混合HMM/MLP异常检测模型,并给出了该模型的训练和检测算法.实验结果表明,该混合系统的漏报率和误报率都低于HMM方法.

First,the anomaly detection method based on hidden Markov model（HMM） is described and its drawbacks are pointed out.Then,a method,which uses multilayer perceptron（MLP） as the probability estimator of hidden Markov model,is proposed to overcome the drawbacks of the HMM-based method.Finally,a new hybrid HMM/MLP anomaly detection model based on system calls is established,and its training and detection algorithms are presented.Experimental results show that the false negative rate and the false positive rate of the hybrid system are both lower than those of the HMM-based method.