王笑,戚湧,李千目.基于时变加权马尔科夫链的网络异常检测模型[J].计算机科学,2017,44(9):136-141, 161
基于时变加权马尔科夫链的网络异常检测模型
Network Anomaly Detection Model Based on Time-varying Weighted Markov Chain
投稿时间:2016-08-08  修订日期:2016-12-19
DOI:10.11896/j.issn.1002-137X.2017.09.027
中文关键词:  网络安全,加权马尔科夫,时变模型,入侵检测
英文关键词:Network security,Weighted Markov,Time varying model,Instruction detection
基金项目:本文受国家自然科学基金项目(61272419),赛尔下一代互联网创新项目(NGII20160122),中兴通讯产学研合作论坛合作项目(2016ZTE04-11)资助
作者单位
王笑 南京理工大学计算机科学与工程学院 南京210094 
戚湧 南京理工大学计算机科学与工程学院 南京210094 
李千目 南京理工大学计算机科学与工程学院 南京210094 
摘要点击次数: 218
全文下载次数: 135
中文摘要:
      随着互联网技术的迅猛发展,网络入侵事件日益频发,入侵检测对于保障网络安全具有重要意义。针对网络入侵检测的迫切需求,提出一种基于时变加权马尔科夫链的网络异常检测模型,使用组合状态转移概率矩阵来描述状态转移。利用DARPA 2000数据集在NT系统上重放时产生的事件log作为实验数据以验证该模型的效果,并与普通时变加权马尔科夫链模型进行比较,仿真实验结果表明该模型能够对网络进行实时入侵检测,具有较高的准确性和较强的鲁棒性,并且能够有效降低误测率和漏测率。
英文摘要:
      With the rapid development of the Internet,the network intrusion events are becoming more and more frequent,and the instruction detection is of great significance to the protection of network security.In view of the urgent demand of real-time instruction detection,a model of network instruction detection based on time-varying weighted Markov chain model was proposed in this paper.This model uses the combined state sequence to describe state transition.The log event generated by the DARPA2000 data set on the NT system was used as the experimental data to carry out simulation experiments,and the time-varying weighted Markov chain model were compared. The simulation results show that the model mentioned in this paper can be used for real-time instruction detection,which has high accuracy,strong robustness,and can effectively reduce the false detection rate.
查看全文  查看/发表评论  下载PDF阅读器