摘要
HMM用来检测一个系统调用短序列是否异常,根据异常系统调用短序列占该进程所有短序列的百分比来判断该进程是否是入侵。考虑到当一个入侵发生时,会产生大量的异常系统调用,导致其邻近系统调用与正常系统调用不匹配。为此我们对HMM的异常检测方法作了进一步改进,改进后的方法对异常更敏感,误报率更低。
The HMMs can be used to predict whether a sequence is ＂abnormal＂ or ＂normal＂. Acco.rding to the percent of the abnormal sequences, we can conclude whether the process is intrusion or not. When an intrusion actually occurs , it generates a number of abnormal system calls, and as a result, the neighboring sequences of system calls will not match the normal sequences. A new anomaly detection method based on HMMs is presented for Intrusion Detection Systems. We demonstrate that the new method has more sensitivity to the abnormals and lower false positives.
出处
《太原科技大学学报》
2008年第1期16-19,共4页
Journal of Taiyuan University of Science and Technology
基金
太原科技大学青年基金项目(2007123)
