基于时变加权马尔科夫链的网络异常检测模型  

Network Anomaly Detection Model Based on Time-varying Weighted Markov Chain

作　　者：王笑[1] 戚湧[1] 李千目[1] 

机构地区：[1]南京理工大学计算机科学与工程学院,南京210094

出　　处：《计算机科学》2017年第9期136-141,161,共7页Computer Science

基　　金：国家自然科学基金项目(61272419);赛尔下一代互联网创新项目(NGII20160122);中兴通讯产学研合作论坛合作项目(2016ZTE04-11)资助

摘　　要：随着互联网技术的迅猛发展,网络入侵事件日益频发,入侵检测对于保障网络安全具有重要意义。针对网络入侵检测的迫切需求,提出一种基于时变加权马尔科夫链的网络异常检测模型,使用组合状态转移概率矩阵来描述状态转移。利用DARPA 2000数据集在NT系统上重放时产生的事件log作为实验数据以验证该模型的效果,并与普通时变加权马尔科夫链模型进行比较,仿真实验结果表明该模型能够对网络进行实时入侵检测,具有较高的准确性和较强的鲁棒性,并且能够有效降低误测率和漏测率。With the rapid development of the Internet, the network intrusion events are becoming more and more fre- quent, and the instruction detection is of great significance to the protection of network security. In view of the urgent demand of real time instruction detection, a model of network instruction detection based on time-varying weighted Markov chain model was proposed in this paper. This model uses the combined state sequence to describe state transi tion. The log event generated by the DARPA2000 data set on the NT system was used as the experimental data to carry out simulation experiments,and the time-varying weighted Markov chain model were compared. The simulation results show that the model mentioned in this paper can be used for real-time instruction detection, which has high accuracy, strong robustness, and can effectively reduce the false detection rate.

关 键 词：网络安全 加权马尔科夫 时变模型 入侵检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]