基于层叠条件随机场的网络入侵识别  

Network intrusion recognition based on cascaded conditional random fields

作　　者：胡广朋[1] 程辉[1] 邵玉宝[1] 

机构地区：[1]江苏科技大学电子信息学院,江苏镇江212003

出　　处：《江苏科技大学学报（自然科学版）》2008年第5期63-66,共4页Journal of Jiangsu University of Science and Technology:Natural Science Edition

基　　金：总装备部武器装备预研基金资助项目(51406020104CB0201)

摘　　要：为了能够在网络环境中从大量底层入侵警报信息中正确有效地识别其背后隐藏的攻击意图和规划,提出了基于层叠条件随机场模型的网络入侵识别方法.该方法首先在低层条件随机场中解决对简单的入侵识别,并将结果传递到高层的条件随机场模型以进行对复杂的入侵识别,实现了自适应、智能化的入侵检测系统.实验结果表明,该方法有较低的误报率,综合看来比传统方法优越.This paper presents a network intrusion recognition method based on cascaded conditional random fields. The method can correctly and effectively recognize the hidden attack intention and plan from the large volume of low level intrusion detection system alerts in the domain of network. At first, simple intrusion recognitions are recognized by the lower model; then the result is passed to the high model to support the recognition of the complicated intrusion. It implements a self-adaptive and intelligent intrusion detection system. The experiments show that the method has the lower false alarm rate, and is better than traditional methods.

关 键 词：入侵检测 层叠条件随机场 规划识别 网络 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]