針對入侵檢測中普遍存在誤報(bào)與漏報(bào)過高的問題，本文提出一種新的基于隱馬爾可夫模型的系統(tǒng)入侵檢測方法。該方法以程序正常執(zhí)行過程中產(chǎn)生的系統(tǒng)調(diào)用序列為研究對象，首先建立計(jì)算機(jī)運(yùn)行狀況的隱馬爾可夫模型，然后在此模型的基礎(chǔ)上提出一個(gè)用于計(jì)算機(jī)系統(tǒng)實(shí)時(shí)異常檢測的算法。實(shí)驗(yàn)證明，用這種方法建模的系統(tǒng)在不影響檢測率的情況下，比傳統(tǒng)的數(shù)據(jù)建設(shè)模節(jié)省存儲(chǔ)空間，并且準(zhǔn)確率高。
關(guān)鍵詞：入侵檢測；異常檢測；隱馬爾可夫模型（HMM）
Abstract: To solving the problem of high ratio of false alarm and self- adaptation,
this paper proposes a new method to network intrusion detection based on HMM
model. This method first research the system call serial in the normal application of
the program to found a HMM for the normal behavior of computer system and to
bring forward an algorithm of anomaly detection. It is proved that this method
increases the rate of accuracy and save more storage space without affecting the
detection rate.
Keywords: intrusion detection; anomaly detection; hidden markov model(HMM)