基于HMM和STIDE的异常入侵检测方法  

Hybrid Anomaly Intrusion Detection Method Using HMM and STIDE

作　　者：孙彦[1] 李永忠[1] 罗军生[1] 

机构地区：[1]江苏科技大学电子信息学院,镇江212003

出　　处：《计算机工程》2008年第3期181-182,共2页Computer Engineering

摘　　要：入侵检测是对正在发生或已经发生的入侵行为的一种识别过程。异常检测是入侵检测的主要分析方法之一。该文在传统的使用单一入侵检测算法的基础上,提出一种基于HMM和STIDE复合算法的异常入侵检测方法。HMM和STIDE复合算法被用来区分未知的行为是合法操作还是一次入侵。实验证明该方法具有低虚警率和高检测率。Intrusion detection is a process of identify the intrusion which had happened or not. Anomaly detection method is one of the main intrusion detection methods. Based on the traditional intrusion detection algorithm using single intrusion detection method, a hybrid method which combines HMM with STIDE is proposed. The HMM along with STIDE is used to categorize an unknown behavior to be either normal or an intrusion. Experimental results prove the hybrid method in low false positive rate with high detection rate.

关 键 词：入侵检测 异常检测 HMM方法 STIDE方法 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]