基于Makov链状态转移概率矩阵的网络入侵检测  

A Network Intrusion Detection Method Based on Fusion of Markov Chain State Transfer Probability Matrix

作　　者：韩红光[1] 周改云[2] 

机构地区：[1]浙江农业商贸职业学院图书信息中心,浙江绍兴312000 [2]平顶山学院计算机学院,河南平顶山467000

出　　处：《控制工程》2017年第3期698-704,共7页Control Engineering of China

基　　金：河南省科技厅科技攻关项目(142102210226)

摘　　要：针对互联网中网络攻击预测问题,提出了一种基于概率模型的网络入侵检测方法(PNID),采用马尔可夫链对网络系统事件进行概率建模,用于预报和检测网络入侵。首先,执行K均值聚类来定义网络状态;然后,基于所定义的状态,构建包括状态概率转移矩阵和初始概率分布的隐马尔科夫模型(HMM);最后,利用模型实时检测输入数据的异常度。通过实验验证了该方法的可行性,并与其他两种方法进行比较,结果表明,该方法针对DDoS攻击具有较高的正确检测率和较低的误报率。此外,该方法对HMM训练数据集和状态数量具有较好的鲁棒性。For the problem of predicting network attacking, a kind of network intrusion detection （PNID） based on probabilistic is proposed, Markov chain is used to build the probability modeling of the network system events so as to predicting and detecting the network intrusion. Firstly, K-means clustering is used to define the state of the network. Then, hidden Markov model （HMM） including state transition probability matrix and initial probability distribution is constructed according to the definition state. Finally, the Markov model is used to detect the anomaly degree of input data. The feasibility of the method has been verified by the experiments comparing with other two methods. Experimental results show that prosed method has higher correct detection rate and lower false alarm rate for DDoS attack. In addition, and it is robust to the Markov model training data set and the number of the state.

关 键 词：入侵检测系统 隐马尔科夫模型 DDOS攻击 K均值聚类 概率转移矩阵 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]