高可用性网络入侵预警方法的改进研究  

High Availability Network Intrusion Early Warning Method Improvement Research

作　　者：龚健虎[1] 

机构地区：[1]广东培正学院计算机科学与工程系,广东广州510800

出　　处：《微电子学与计算机》2016年第8期134-138,共5页Microelectronics & Computer

摘　　要：高可用性网络通常会受到海量恶意入侵,当前预警方法只能对历史与当前的网络入侵情况进行分析,无法预测未来高可用性网络的入侵情况,为了提高预警精度,提出一种新的高可用性网络入侵预警改进方法,介绍了隐马尔可夫模型,在此基础上,构建依据HMM模型的实时高可用性网络入侵预警模型,依据危险理论对评估结果进行分析,将高可用性网络状态划分成四个等级,通过构建的HMM-NSSP模型实现网络入侵预警.为了提高HMMNSSP模型的预警精度,引入最大熵法对高可用性网络安全态势进行一致性判定,完成高可用性网络入侵预警方法的改进,实验结果表明,所提方法预警结果和实际结果基本一致,具有很高的预警精度,可用性很高.High availability network usually are a huge number of malicious invasion of current early warning method can only analyze the history and the current network intrusion status, cannot predict the future high availability network invasion situation, in order to improve the accuracy of early warning, put forward a new high availability network intrusion early warning method, this paper introduces the hidden markov model, on this basis, the building based on the HMM model of real-time high availability network intrusion early warning model, according to the analysis of risk theory to the evaluation result, the high availability network state was divided into four grades, by building the HMM NSSP model to realize the network intrusion early warning. In order to improve the early warning of the HMM - NSSP model precision, the introduction of the maximum entropy method for high availability network security situational consistency judgement, to complete the high availability of network intrusion early warning method improvement, the experimental results show that the proposed method the early warning results and actual results are basically identical, has the very high accuracy of early warning, a high availability.

关 键 词：高可用性网络 入侵 预警 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]