基于hmm的協(xié)議異常檢測技術(shù)研究

1、北京交通大學碩士學位論文基于HMM的協(xié)議異常檢測技術(shù)研究姓名：向虹申請學位級別：碩士專業(yè)：計算機應(yīng)用技術(shù)指導(dǎo)教師：田盛豐20071201韭塞窒疊塞篷縷盤翌整建鑾繾隘￡蘭ABSTRACTWiththedevelopmentofthenetworktechnologyandtheexpandingutilizationofthetechnologythenetworksecurityproblemsbecomeincreasinglys“￡

2、∞。AnumberofsecuritytechnologiesandmechanismshavebeendevelopedtoenhancethesecurityofcomputernetworkAmongthetechnologies，theprotocolanomalydetectionisanewtechnologyoftheanomalydetectionComparedwithothertraditionalanomalyde

3、tectiontechnologiestheprotocolanomalydetectionismoreefficientandfasterSoitCallreducethedamageofnetworkattackmoreeffectivelyBasedonthedeepanalysisofarchitectureanddetectiontechnologiesofexistingIDS(IntrusionDetectionSyste

4、m)，anewprotocolanomalydetectiontechnologybasedonHMM(HiddenMarkovModel)isintroducedinthispaperAndWehaveachievedthefollowingresultsonourresearch：1Introducingprotocolanalysistotheanomalydetectionit跚buildthenormalbehaviormod

5、elsmoreexactlythanotheranomalydetectiontechnologies2IntroducingHMMmethodtotheanomalydetectionithasmuchmoreadvantagesthanothermethodswhenbuildingmodels3。Improvingthetraditionalmodelestimationalgorithmtolllakethemodelmorep

6、ractical4PuttingforwardanalgorithmbasedonHMTdwhichisappliedtoprotocolanomalydetectionThisalgorithmhashigherageuraterate，butrequiressmallerstorageandit’Ssimpletoimplement5Designingandimplementingaprotocolanomalydetectionm

7、odulebasedon囂隧醚AndexperimentsdemonstratedthatthesystemcouldrespondtoanomalyprotocolimmediatelyandreasonablyconcludedthatthetrafficwhichdeviatesfromthenormalmodelcontainedintrusionbehaviorsSoithasachievedthegoalofourdesig

8、nThispaperfirstintroducesthebasicconceptgeneralfeaturesanddifferentclassificationofintrusiondetectiontechnologyandHMM，thendescribestheprotocolanomalydetectiontechnologybasedonHMMindetail，whichisthekeycontentofthispaperFi