基于条件随机场的协议异常检测  

Protocol anomaly detection based on conditional random field

作　　者：赵静[1] 谷鹏飞 何亚南 延霞[1] ZHAO Jing;GU Pengfei;HE Yanan;YAN Xia(School of Computer Sciences,Shenzhen Institute of Information Technology,Shenzhen,Guangdong 518172,P.R.China;State Key Laboratory of Nuclear Power Safety Monitoring Technology and Equipment,China Guangdong Nuclear Engineering Co.,Ltd.,Shenzhen,Guangdong 518000,P.R.China)

机构地区：[1]深圳信息职业技术学院计算机学院,广东深圳518172 [2]中广核工程有限公司核电安全监控技术与装备国家重点实验室,广东深圳518000

出　　处：《深圳信息职业技术学院学报》2018年第2期50-55,共6页Journal of Shenzhen Institute of Information Technology

基　　金：深圳信息职业技术学院横向课题(HX-173)

摘　　要：提出了一种基于条件随机场的协议异常检测模型。该方法将连接中的数据包作为观测序列,量化数据包首部的标志位,计算标志位在连接中的出现频率作为观测序列的两个特征,实验结果验证了所建立模型的准确性,同基于隐马尔科夫模型的检测方法相比,提出的方法在各个衡量标准上都要高于后者。This paper proposes a protocol anomaly detection model based on conditional random field（CRF）. The method uses the data packet in the connection as the observation sequence, quantizes the flag of the packet header, and calculates the frequency of occurrence of the flag in the connection as two characteristics of the observation sequence. The experimental results verify the accuracy of the established model. Compared with the detection method based on Hidden Markov Model, the proposed method is higher than the latter in each measurement standard.

关 键 词：条件随机场 入侵检测 协议异常检测 

分 类 号：TP181[自动化与计算机技术—控制理论与控制工程] TP393.08[自动化与计算机技术—控制科学与工程]