The Applications of Hidden Markov Models with States Depending on Observations to Computer Intrusion Detection

摘要

In this paper, the problem of the applications of hidden Markov models with states depending on observations (HMMSDO) to computer intrusion detection is discussed. By introducing the relative entropy density divergence as a measure of the intrusion detection system (IDS) models, dependencies of the HMM and the HMMSDO are compared. Empirical results show that a HMMSDO's probability distribution conforms to the real probability distribution of the original audit data. A HMMSOO may perform better than a standard HMM in computer intrusion detection.