信息网络安全

信息网络安全 ›› 2016, Vol. 16 ›› Issue (9): 108-112.doi: 10.3969/j.issn.1671-1122.2016.09.022

• • 上一篇    下一篇

基于改进HMM的程序行为异常检测方法

吴鑫(), 严岳松, 刘晓然   

  1. 海军指挥学院,江苏南京 211800
  • 收稿日期:2016-07-25 出版日期:2016-09-20 发布日期:2020-05-13
  • 作者简介:

    作者简介： 吴鑫（1992—）,男,陕西,硕士研究生,主要研究方向为信息安全理论与技术;严岳松（1985—）,男,江苏,讲师,硕士,主要研究方向为信息安全;刘晓然（1964—）,男,江苏,教授,博士,主要研究方向为信息安全。

Program Behavior Anomaly Detection Method Based on Improved HMM

Xin WU(), Yuesong YAN, Xiaoran LIU   

  1. Naval Command College, Nanjing Jiangsu 211800, China
  • Received:2016-07-25 Online:2016-09-20 Published:2020-05-13

RichHTML

6

PDF (PC)

179

摘要：

程序行为的异常检测是网络异常检测中的重要部分,针对传统隐马尔科夫模型中状态转移概率及观测值概率仅与前一状态有关的不足,而导致误报率高、检测效率低的问题。文章提出一种改进的基于隐马尔科夫模型的检测方法,该方法重点是利用系统调用局部规律性来建模;同时为了减少模型训练时间,该模型采用更为简单快捷的参数重估方法。最后,通过仿真实验,与传统HMM模型和二阶HMM做横向对比,证明了该模型的实用性。

关键词: 程序行为, 异常检测, 隐马尔科夫模型

Abstract:

Anomaly detection of program behavior is an important part of network anomaly detection. In traditional HMM, the probability of transition and the probability of the observed value is only related to the previous state, which leads to high false alarm rate and low detection rate. In this paper an improved 2HMM detection method is proposed, which is based on local regularity of the system calls. And in order to reduce the training time, the model uses a more simple parameter estimation algorithm. Finally, through the experiment, compared with the traditional HMM and traditional 2HMM,the superiority of the model is proved.

Key words: program behavior, anomaly detection, HMM

中图分类号: