一种基于隐马尔可夫链的网络入侵检测研究

THE RESEARCH ABOUT NETWORK INTRUSION DETECTION BASED ON THE HMM

提出了一种基于HMM的网络异常入侵建模方法,使用隐马尔可夫模型中的Baum-welch算法识别攻击者攻击意图,给出了计算P(O|λ)和阈值的算法。仿真实验数据基于林肯实验室提供的入侵检测数据集,对系统进行了测试与性能分析,并与Snort系统比较,具有一定的应用价值。

JIAYIN Propose an abnormal invasion modeling methods based on HMM, use the Baum -welch al- gorithm of Hidden Markov Model to identify the attacker＇s intention, given algorithms about the calculation of P （O｜λ） and the threshold value. The experimental data is provided by the Lincoln Laboratory intrusion detection data sets. The system was tested and performance analysis, and compared with the snort system.