基于节点生长马氏距离K均值和HMM的网络入侵检测方法设计

发布时间：2018-06-25 18:32

本文选题：网络入侵检测 + K均值　；参考：《计算机测量与控制》2014年10期

【摘要】：传统的网络入侵检测方法存在着检测率低和无法进行在线检测的问题,为此设计了一种基于节点生长马氏距离K均值和HMM的网络入侵检测方法;首先,给出了入侵检测系统框图,然后,以马氏距离为评价准则,提出了一种节点根据距离阈值进行自适应生长的K均值算法以实现样本的聚类,得到样本属于各攻击类型的后验概率,并采用此后验概率来初始化HMM中的初始矢量分布、状态转移概率和观察值概率等参数,通过前向评估准则和后向评估准则对HMM模型进行训练,从而获得了HMM检测模型,将样本输入到各检测模型中并将概率最大的检测模型作为其攻击类型;仿真试验表明所提方法能有效地实现网络入侵检测,不仅具有较高的检测率,而且具有较低的误检率和漏检率,是一种有效的网络入侵检测方法。
[Abstract]:Traditional network intrusion detection methods have the problems of low detection rate and no on-line detection. Therefore, a network intrusion detection method based on node growing Markov distance K-means and hmm is designed. The block diagram of intrusion detection system is given, and then, taking Markov distance as the evaluation criterion, a K-means algorithm for adaptive growth of nodes according to distance threshold is proposed to realize the clustering of samples. The posteriori probability of each attack type is obtained, and the initial vector distribution, state transition probability and observation probability in hmm are initialized by a posteriori probability. The hmm model is trained by the forward evaluation criterion and the backward evaluation criterion, and the hmm detection model is obtained. The sample is input into each detection model and the most probabilistic detection model is used as its attack type. Simulation results show that the proposed method not only has high detection rate, but also has low false detection rate and missed detection rate, so it is an effective network intrusion detection method.
【作者单位】：安阳工学院科研处;安阳工学院人事处;
【基金】：国家自然科学基金项目(U1204613)
【分类号】：TP393.08

【参考文献】