改进的基于隐马尔可夫模型的态势评估方法

摘要

针对隐马尔可夫模型(HMM)参数难以配置的问题,提出一种改进的基于隐马尔可夫模型的态势评估方法,更加准确地反映网络的安全态势.所提方法以入侵检测系统的输出作为输入,根据Snort手册将报警事件分类,得到观测序列,建立HMM,将改进的模拟退火(SA)算法与Bauw_Welch (BW)算法相结合对HMM参数进行优化,使用量化分析的方法得到网络的安全态势值.实验结果表明,所提方法能较好地提升模型的精度与收敛速度.%Concerning the problem that the Hidden Markov Model (HMM) parameters are difficult to configure,an improved method of situation assessment based on HMM was proposed to reflect the security of the network.The proposed method used the output of intrusion detection system as input,classified the alarm events by Snort manual to get the observation sequence,and established the HMM model,the improved Simulated Annealing (SA) algorithm combined with the Baum_Welch (BW) algorithm to optimize the HMM parameters,and used the method of quantitative analysis to get the security situational value of the network.The experimental results show that the proposed method can improve the accuracy and convergence speed of the model.