一种基于隐Markov模型的异常检测技术  

Anomaly detection technique based on hidden Markov model

作　　者：安景琦[1] 刘贵全[1] 钱权[1] 

机构地区：[1]中国科学技术大学计算机科学技术系,安徽合肥230027

出　　处：《计算机应用》2005年第8期1744-1746,共3页journal of Computer Applications

基　　金：国家自然科学基金资助项目(90104030)

摘　　要：给出了一种建立隐Markov异常检测模型的算法,并从序列支持度分析、序列预测两个方面研究了该模型在异常检测中的应用,通过实验,分析了影响这一检测方法效果和效率的因素。实验表明,该方法能在不需要任何安全方面背景知识的情况下,有效地检测出入侵行为。An algorithm was given to making a kind of HMM(Hidden Markov Model) for anomaly detection. The application in anomaly detetction of the model was introduced from analyzing on support of sequence and sequence prediction.Factions which inflect results and efficiency were discussed by the experiments. And the experiments also show that the method can detect intrusion without any security knowledge.

关 键 词：异常检测 隐MARKOV模型 系统调用 滑动窗口 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]