基于条件随机场的协议异常检测

Protocol anomaly detection based on conditional random field

提出了一种基于条件随机场的协议异常检测模型。该方法将连接中的数据包作为观测序列,量化数据包首部的标志位,计算标志位在连接中的出现频率作为观测序列的两个特征,实验结果验证了所建立模型的准确性,同基于隐马尔科夫模型的检测方法相比,提出的方法在各个衡量标准上都要高于后者。

This paper proposes a protocol anomaly detection model based on conditional random field（CRF）. The method uses the data packet in the connection as the observation sequence, quantizes the flag of the packet header, and calculates the frequency of occurrence of the flag in the connection as two characteristics of the observation sequence. The experimental results verify the accuracy of the established model. Compared with the detection method based on Hidden Markov Model, the proposed method is higher than the latter in each measurement standard.