改进的基于隐马尔可夫模型的态势评估方法  

Improved method of situation assessment method based on hidden Markov model

作　　者：李方伟[1] 李骐[1] 朱江[1] LI Fangwei LI Qi ZHU Jiang(Chongqing Key Laboratory of Mobile Communications Technology （ Chongqing University of Posts and Telecommunications）, Chongqing 400065, Chin)

机构地区：[1]重庆市移动通信重点实验室(重庆邮电大学),重庆400065

出　　处：《计算机应用》2017年第5期1331-1334,1340,共5页journal of Computer Applications

基　　金：国家自然科学基金资助项目(61271260);重庆市科委自然科学基金项目(cstc2015jcyj A40050)~~

摘　　要：针对隐马尔可夫模型(HMM)参数难以配置的问题,提出一种改进的基于隐马尔可夫模型的态势评估方法,更加准确地反映网络的安全态势。所提方法以入侵检测系统的输出作为输入,根据Snort手册将报警事件分类,得到观测序列,建立HMM,将改进的模拟退火(SA)算法与Bauw_Welch(BW)算法相结合对HMM参数进行优化,使用量化分析的方法得到网络的安全态势值。实验结果表明,所提方法能较好地提升模型的精度与收敛速度。Concerning the problem that the Hidden Markov Model （HMM） parameters are difficult to configure, an improved method of situation assessment based on HMM was proposed to reflect the security of the network. The proposed method used the output of intrusion detection system as input, classified the alarm events by Snort manual to get the observation sequence, and established the HMM model, the improved Simulated Annealing （SA） algorithm combined with the Baum_Welch （BW） algorithm to optimize the HMM parameters, and used the method of quantitative analysis to get the security situational value of the network. The experimental results show that the proposed method can improve the accuracy and convergence speed of the model.

关 键 词：网络安全 隐马尔可夫模型 参数优化 模拟退火算法 态势评估 

分 类 号：TN393.08[电子电信—物理电子学]