计算机系统入侵检测的隐马尔可夫模型

入侵检测技术作为计算机安全技术的一个重要组成部分，现在受到越来越广泛的关注，首先建立了一个计算机系统运行状况的隐马尔可夫模型（HMM），然后在此模型的基础上提出了一个用于计算机系统实时异常检测的算法，以及该模型的训练算法。这个算法的优点是准确率高，算法简单，占用的存储空间很小，适合用于在计算机系统上进行实时检测。

A Hidden Markov Model Used in Intrusion Detection

As the key component of computer security technique, intrusion detection has received more and more attention. In this paper, an overview of research in anomaly detection is presented with emphasis on issues related to found a hidden Markov model (HMM) for the normal states of computer system, and an algorithm of anomaly detection is brought forward. The probability of observed sequence is computed and the average probability of a fixed length sequence is used as the metric of anomaly detection. To improve accuracy, an update algorithm for this hidden Markov model is also presented based on the forgetting factor. This method is not only useful in theory, but also can be used in practice to monitor the computer system in real time.