• •    

一种改进的基于隐马尔可夫模型的态势评估方法

李方伟1,李骐2,朱江1   

  1. 1. 移动通信技术重庆市重点实验室(重庆邮电大学),重庆 400065
    2. 重庆邮电大学
  • 收稿日期:2016-11-01 修回日期:2016-12-05 发布日期:2016-12-05
  • 通讯作者: 李骐

An Improved Method of Situation Assessment Method Based on Hidden Markov Model

LI Fangwei1, ZHU Jiang1   

  • Received:2016-11-01 Revised:2016-12-05 Online:2016-12-05

摘要: 随着“互联网+”行业持续发酵,网络安全的重要性被提升到前所未有的高度。针对隐马尔可夫模型参数难以配置的问题,提出一种改进的基于隐马尔可夫模型(HMM)的态势评估方法,更加准确的反映网络的安全态势。该方法以入侵检测系统的输出作为输入,根据Snort手册将报警事件分类,得到观测序列,建立HMM模型,将改进的模拟退火算法(SA)与Bauw_Welch算法相结合对HMM参数进行优化,使用量化分析的方法得到网络的安全态势值。实验结果表明,该方案能较好提升模型的精度与收敛速度。

关键词: 网络安全, 隐马尔可夫模型, 参数优化, 模拟退火算法, 态势评估

Abstract: With continuous fermentation “Internet+” industry, the importance of network security was promoted to unprecedented levels. To cope with Hidden Markov Model (HMM) parameters are difficult to configure, an improved method of situation assessment based on Hidden Markov Model (HMM) was proposed, more accurately reflect the security of the network. This method takes the output of intrusion detection system as input, classify the alarm events based on Snort manual, get the observation sequence, to establish the HMM model, the improved simulated annealing algorithm (SA) combined with the Baum_Welch algorithm (BW) to optimize the HMM parameters, using the method of quantitative analysis to get the security situational values of the network. The experimental results show that the scheme can improve the accuracy and convergence speed of the model.

Key words: network security, hidden Markov model, parameter optimization, simulated annealing algorithm, situation Assessment

中图分类号: