Research On Host Intrusion Protection Based On ANN And Markov Model

In recent years, attentions to security threats facing computer networks were increasingly paid by security experts. Traditional intrusion detection techniques carried defects of high missing report and false alarm rate, and can not recognize unknown type of attacks well. Though the concept of Intrusion Protection System (IPS) was proposed later, it can not meet the demands of high-speed networks. In the meantime, IPS doesn't perform well in detection of unknown type attacks.Against the limitations of host intrusion detection techniques, intrusion protection techniques based on Cerebellar Model Articulation Controller(CMAC) artificial neural networks and hidden Markov model were proposed in this paper. First, intrusion detection architecture based on CMAC artificial neural networks and hidden Markov model were put forward. An intrusion protection model based on this hybrid application was designed, and functions of models were stated in detail.Then, detection engine in this intrusion protection system was designed. The principle of the detection engine was described. Find out optimum system call with hidden Markov model. The data processed with hidden Markov model could be detected by CMAC neural networks in an anomaly way. With association character of CMAC neural networks, data could be rapidly classified and recognized as an intrusion behavior.At last, the intrusion protection system in this paper were manifested a higher performance than those Back propagation(BP) artificial neural networks systems by simulation tests. Then, the deficiencies of the system in this paper were explained, and what should be done in future to this intrusion protection system was discussed.