Hidden Markov Model-based Intrusion Detection System Research

With the unceasing update and progress of network technology, various viruses and attacks in the network have been improved and developed. By now network attacks have become gradually covert, which causes the steadily rising economic losses year by year. Network security has become the primary problem people are concerned with. As an effective way of attack prevention, intrusion detection technologies play a vital role in network security.In this paper the author makes the analysis of the existing information system bug, network attack techniques and network intrusion detection techniques in detail. At present, the methods of network attack become various and concealed. In order to enhance the detection rate of intrusion detection system, it is necessary to maintain a huge feature database in system, which makes it very hard to improve the detection rate and real-time. To make up the insufficiency of the present intrusion detection system, in this paper analysis flag state of network packet during the network packet transmission, and build a feature database of intrusion detection system through HMM. This feature database has small volume.When building this intrusion detection system, it adopts the model of abnormal network intrusion detection. It's not only build the intrusion detection model on the basis of HMM through the analysis of the variation laws of the flags and ports state in network protocol implementation under normal network circumstances but also optimizes the parameters of the build model by means of Baum-Welch algorithm.To improve the detection rate of the detection system, this paper proposed a self-adaptive sliding detection window algorithm which involves the FCM cluster algorithm and the Conditional Entropy algorithm. According to the flag state of the network packet sequence, this algorithm could automatically adjust the length of current sliding window. The realization of the algorithm makes itself successful all the time to detect the flag state of the network packet sequence with proper sliding window which improves the timeliness and effectiveness of the detection model.Experiments show that the intrusion detection model with the self-adaptive sliding detection window algorithm could evidently increase the detection rate of network attack and stand at 98%, which makes it clear that the detection rate of network attack is highly improved to resist a large quantity of network attacks.