期刊文献+
任意字段
题名或关键词
题名
关键词
文摘
作者
第一作者
机构
刊名
分类号
参考文献
作者简介
基金资助
栏目信息

模糊窗口Markov链在IDS中的应用

Application of fuzzy window Markov chain in IDS
下载PDF
导出
摘要 针对传统的基于静态M arkov模型的前提假设(t+1时刻系统状态的转移概率分布只与t时刻的状态有关,与t时刻以前的状态无关)带来较大误差的不足,提出了一种新的窗口M arkov链方法,并且在窗口M arkov模型中引入模糊度量。实验验证该模型对正常行为和异常行为具有很好的区分度,且计算快捷,适用于实时检测。 The traditional static Markov model is based on such premise of assumptions as transition probability distribution of system mode of t ＋ 1 moment is only interrelated with the state at time t but not with that before time t, which brings big error. Therefore, a new window Markov chain was put forward, and fuzzy measure was introduced into it. The experiment confirms that this model has a good discrimination to the normal behavior and the unusual behavior, and has a faster calculation speed, and it is suitable for the on-line detection.
作者 赵文刚 钟乐海 张娅 杨金 邹海洋
机构地区 西华师范大学计算机学院 西南交通大学信息科学与技术学院
出处 《计算机应用》 CSCD 北大核心 2008年第6期1398-1400,1403,共4页 journal of Computer Applications
基金 四川省科技攻关资助项目(05GG009-018)
关键词 异常检测 MARKOV链 系统调用 模糊 anomaly detection Markov chain system call fuzzy
分类号 TP393.08 [自动化与计算机技术—计算机应用技术] TP309 [自动化与计算机技术—计算机系统结构]
  • 相关文献

参考文献9

  • 1BACE R. Intrusion detection [ M]. New York: Macmillan Technical Publishing, 2000.
  • 2FORREST S, HOFMEYR S A, SOMAYAJI A, et al. A sense of self for unix processes [ C]//IEEE Symposium on Security and Privacy Proceedings. Oakland, CA: IEEE Computer Society Press, 1996:120 - 128.
  • 3LEE W, STOLFO S, CHAN P. Learning patterns from Unix process execution traces for intrusion detection [ C]// Proceeding of AAAI Workshop: AI Approaches to Fraud Detection and Risk Management. [S. l. ]: AAAI Press, 1997:191 -197.
  • 4HOFMEYR S A, FORREST S, SONMAYAJI A. Intrusion detection using sequence of system calls [ J]. Journal of Computer Security, 1998,6(3) : 151 - 180.
  • 5LANE T, BRODLEY C E. Temporal sequence learning and data reduction for anomaly detection [ C]// Proceeding of the 5th ACM Conference on Computer & Communication Security. New York: ACM Press, 1998:295-331.
  • 6RAMAN C V, NEGI A. A hybrid method to intrusion detection systems using HMM [ C]// ICDCIT 2005, LNCS 3816. Berlin: Springer-Verlag, 2005: 389-396.
  • 7KWAKENAAK H. Fuzzy random variables. Part Ⅰ: Definitions and theorems [J]~ Information Sciences, 1978, 15:1-29.
  • 8WENKE L, DONG XIANG. Information-theoretic measures for anomaly detection [ C]// Proceedings of the 2001 IEEE Symposium on security and Privacy. Washington: IEEE Press, 2001:130 - 143.
  • 9邬书跃,田新广.基于隐马尔可夫模型的用户行为异常检测新方法[J].通信学报,2007,28(4):38-43. 被引量：20

二级参考文献9

  • 1田新广,高立志,张尔扬.新的基于机器学习的入侵检测方法[J].通信学报,2006,27(6):108-114. 被引量：15
  • 2LANE T.Machine Learning Techniques for the Computer Security Domain of Anomaly Detection[D].Purdue University,2000.
  • 3LEE W,DONG X.Information-theoretic measures for anomaly detection[A].Proceedings of the 2001 IEEE Symposium on Security and Privacy[C].Oakland,USA,2001.130-134.
  • 4LANE T,BRODLEY C E.Temporal sequence learning and data reduction for anomaly detection[J].ACM Transactions on Information and System Security,1999,2(3):295-331.
  • 5WARRENDER C,FORREST S,PEARLMUTTER B.Detecting intrusions using system calls:alternative data models[A].Proceedings the 1999 IEEE Symposium on Security and Privacy[C].Berkely,USA:IEEE Computer Society,1999.133-145.
  • 6LANE T,BRODLEY C E.An application of machine learning to anomaly detection[A].Proceedings of the 20th National Information Systems Security Conference[C].Baltimore,USA,1997.366-377.
  • 7连一峰,戴英侠,王航.基于模式挖掘的用户行为异常检测[J].计算机学报,2002,25(3):325-330. 被引量：85
  • 8田新广,高立志,李学春,张尔扬.一种基于隐马尔可夫模型的IDS异常检测新方法[J].信号处理,2003,19(5):420-424. 被引量：6
  • 9孙宏伟,田新广,李学春,张尔扬.一种改进的IDS异常检测模型[J].计算机学报,2003,26(11):1450-1455. 被引量：21

共引文献19

计算机应用
2008年 第6期

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部