基于隐马尔科夫模型和神经网络的入侵检测研究

摘要

针对目前的基于隐马尔科夫模型的入侵检测和基于神经网络入侵检测各自的不足之处,提出一种基于隐马尔科夫模型和神经网络的混合入侵检测方法.主要是从网络协议的角度入手,把TCP数据包作为分析对象,给出一种确定观察值的方法,把隐马尔科夫模型的输出作为神经网络的输入,神经网络的输出是最终的结果.最后通过实验证明了此混合入侵检测方法比单独使用隐马尔科夫模型或者是单独使用神经网络的检测方法有更低的误报率和漏报率.%Based on the disadvantages of intrusion detections based on Hidden Markov model and on neural network respectively, this paper proposed a hybrid of intrusion detection with the combination of the above two ways. It commences from the point of view of network protocol and takes TCP data packet as the analytic object, gives a kind of method of observation determination, the output of hidden Markov model is used as the input of neural network, and the neural network output is our final result. At last the experiments revealed that this hybrid intrusion detection method reaches a lower false alarm rate and missing rate than the method using either hidden Markov model or neural network alone.