Approach To Forecasting Multi-step Attack Based On Hidden Markov Model

With the change of time,the inside and outside of network environment is changing constantly.If the security policies and measures fail to catch up,the protected network system will become less secure.Therefore,it is particularly important that a security model can be automatically adjusted to identify and predict the security model according to the change and development of the attack.Be in hybrid current mainstream means of attack under the environment,this thesis put forward a method to hidden Markov model to predict the composite attacks based on composite attack can solve better prediction attack intention to predict and alarm information errors leading to attack intention sequence calculation error and other issues in the study,and can effectively improve the HMM the effect of training,so as to improve the prediction accuracy of composite type attack.The attack is the composite monitoring alarm information is that we can directly observe the information,but in a combined attack,to achieve an attack intention,an attacker can take many different kinds of attacks,the intrusion detection system will be made out of many different kinds of alarm information to each of the different means of attack,this it shows the same attack intention may have many different kinds of alarm information.So,to find out the real intention of the attack is the useful information we have to get.In this paper,the improved Baum-Welch algorithm is used to train the HMM model to generate a new HMM model.The improved Baum-Welch algorithm increases the learning and adaptability before intersecting.Then the Forward algorithm is used to calculate the probability of the alarm information sequence in the HMM model.In the alarm information after pretreatment still false positives when get the classic Viterbi algorithm of the attack intention sequence may have the deviation,this paper improved Viterbi algorithm,the accuracy of the calculation of the alarm sequence corresponding to the sequence information of optimal attack intention is higher.According to the result of the simulation can be proved through improved training method and optimization method and attack intention recognition judgment and prediction of hidden Markov model based on composite attack behavior to better effect of the traditional hidden Markov model than before and,in four kinds of compound attack current prediction method,the optimal performance prediction method of hidden Markov based on the model.