关键词: 分类, 离散性函数, 自适应, 隐马尔可夫模型, 入侵检测系统

Abstract: Concerning the problem that untrusted sample can be easily introduced in traditional methods, an adaptive model was proposed in this paper. Based on the description of the structural feature of Request-URL, a whole sample set was divided into smaller subsets. The discreteness of a subset was calculated by its properties, which would determine whether the subset is normal. On basis of these, the detection model was created by the improved algorithm with the normal subsets, and dynamic update of model was achieved by Hidden Markov Model (HMM) merging. The experimental results show that the adaptive model built by the proposed method can effectively identify Web-based attacks and reduce false alert ratio.

Key words: classification, discrete function, adaptive, Hidden Markov Model (HMM), Intrusion Detection System (IDS)