Abstract: An algorithm was given to making a kind of HMM(Hidden Markov Model) for anomaly detection. The application in anomaly detetction of the model was introduced from analyzing on support of sequence and sequence prediction.Factions which inflect results and efficiency were discussed by the experiments. And the experiments also show that the method can detect intrusion without any security knowledge.

Key words: anomaly detection, hidden Markov model, system call, slide window

摘要： 给出了一种建立隐Markov异常检测模型的算法,并从序列支持度分析、序列预测两个方面研究了该模型在异常检测中的应用,通过实验,分析了影响这一检测方法效果和效率的因素。实验表明,该方法能在不需要任何安全方面背景知识的情况下,有效地检测出入侵行为。

关键词: 异常检测, 隐Markov模型, 系统调用, 滑动窗口