HMM模型在检测复杂网络攻击中的应用  

Application of HMM to detecting sophisticated network attacks.

作　　者：陶龙明[1] 史志才[1] 彭丹[1] 马武[1] 

机构地区：[1]大连大学辽宁省智能信息处理重点实验室,辽宁大连116622

出　　处：《计算机工程与应用》2008年第7期136-138,共3页Computer Engineering and Applications

基　　金：辽宁省教育厅高等学校科学技术研究项目(No.20040046)

摘　　要：对于隐蔽性强、持续时间长且分步完成的复杂网络攻击,现有的入侵检测技术仍无法有效地进行识别。详细地分析了复杂网络攻击的特征,并在此基础上建立了复杂网络攻击的HMM检测模型。通过关联分析不同网络监视器的报警事件,产生用于HMM模型训练及检测的报警序列,这些报警序列本质上反映了攻击者的行为。实验结果表明,该模型能较好地检测复杂网络攻击。Sophisticated network attacks are well disguised,durative and multi-stage;it can not be detected effectively by current intrusion detection technology.The native properties of sophisticated network attacks have been analyzed thoroughly in this paper, and then a detection model of sophisticated network attacks based on HMM is built.According to properties of sophisticated network attacks,lots of alarm sequences used by HMM are produced from different monitors distributed in real network. Experiments show that this model is effective in detecting sophisticated network attacks.

关 键 词：入侵检测 HMM模型 网络攻击 报警序列 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]