基于HMM的数据库异常检测方法

HMM-based Database Intrusion Detection approach

随着数据库系统在企业的普遍使用,以及数据库的作用日益重要,数据库的安全问题也随之变得更加严峻。探讨了数据库系统的安全问题,阐述了数据库异常检测系统的重要性,详细研究了隐马尔可夫(HMM)模型,介绍了HMM模型的参数估计的方法。运用HMM模型对数据库系统的事件序列进行建模,以数据库系统日志作为训练集,建立正常状态下的用户行为轮廓,并以当前用户事件的最大似然概率与正常用户行为轮廓的偏离程度来检测异常。

With the increasingly important role of the widespread use of database systems in the enterprise, database security issues are becoming more severe. This paper discusses the security issues of database systems, describes the importance of database anomaly detection system, presents a detailed study of the hidden Markov （HMM） model, introduces the method of HMM parameter estimation. Using the database the system log as a training set, this paper use the HMM model ＂~o model the sequence of events for the database s2stem to establish the contours of the user behavior in the normal state, the deviation degree of current user event maximum likelihood probability from normal user behavior profile is used to detect anomalies.