摘要： 入侵检测是对正在发生或已经发生的入侵行为的一种识别过程。异常检测是入侵检测的主要分析方法之一。该文在传统的使用单一入侵检测算法的基础上，提出一种基于HMM和STIDE复合算法的异常入侵检测方法。HMM和STIDE复合算法被用来区分未知的行为是合法操作还是一次入侵。实验证明该方法具有低虚警率和高检测率。

关键词: 入侵检测, 异常检测, HMM方法, STIDE方法

Abstract: Intrusion detection is a process of identify the intrusion which had happened or not. Anomaly detection method is one of the main intrusion detection methods. Based on the traditional intrusion detection algorithm using single intrusion detection method, a hybrid method which combines HMM with STIDE is proposed. The HMM along with STIDE is used to categorize an unknown behavior to be either normal or an intrusion. Experimental results prove the hybrid method in low false positive rate with high detection rate.

Key words: intrusion detection, anomaly detection, Hidden Markov Model(HMM), Sequence Time Delay Embedding(STIDE)

中图分类号: 

• TP393