A New Anomaly Detection Method Based on Hierarchical HMM

摘要：

The state transition, which is hidden in the hidden Markov model (HMM), can be used to characterize the intrinsic difference between normal action and intrusion behavior. So HMM is an efficient way to detect anomalies. In this paper, a new anomaly detection method based on a hierarchical HMM is proposed based on the concept of normal database and abnormal database. It is shown by analysis and simulation results that the proposed method is effective to increase the accuracy of anomaly detection.

关键词： Anomaly detection hidden Markov model (HMM) intrusion detection system (IDS)

作者: Xiaoqiang Zhang Pingzhi Fan Zhongliang Zhu

作者单位: School of Computer and Communications Enginerring, Southwest Jiaotong University Chengdu 610031, China

会议类型: 国际会议

会议名称: Proceedings of The Fourth International Conference on Parallel and Distribyted Computing,Applications and Technologies(第四届并行与分布式计算应用与技术国际会议)

会议地点: 成都

会议语种:英文

页码: 249-252

在线出版日期: 2003-08-27（万方平台首次上网日期，不代表论文的发表时间）