基于改进隐马尔可夫模型的网络攻击检测方法  

Improved HMM model based method for detecting cyber attacks

作　　者：杨晓峰[1] 孙明明[1] 胡雪蕾[1] 杨静宇[1] 

机构地区：[1]南京理工大学计算机系,江苏南京210094

出　　处：《通信学报》2010年第3期95-101,共7页Journal on Communications

基　　金：江苏省"六大人才高峰"资助项目(07-E-015)~~

摘　　要：提出了一种基于改进隐马尔可夫模型的网络攻击检测方法。正常的网络行为符合一定的语法规则,异常的行为会偏离正常的语法规则。通过对正常行为样本的学习得到的基于隐马尔可夫模型的语法可以根据网络行为和语法的符合程度有效地检测正常行为和攻击行为。在基于现实数据的实验测试中,得到了比较好的检测性能。An improved HMM model based method for detecting cyber attacks was proposed. Normal network behaviors followed a regular grammar, while anomalies deviated the normal grammar. Grammar model represented by HMM model trained with normal network behavior samples easily distinguished normal and malicious requests by their contrasting conforming degrees. A significantly improved performance was achieved in real data tests compared with other anomaly methods.

关 键 词：网络安全 网络攻击 入侵检测 隐马尔可夫模型 语法推断 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]