HMM-based integration of multiple models for intrusion detection
Xiuqing Chen, Zhang Yongping, Tang Jiutao · 2010
In this paper, a novel intrusion detection system based on hidden Markov model, analyzing with Fast Adaptive Clustering Algorithm, combining the characteristic of dynamic adaption and sniffing from multi-model has been proposed. The proposed detection model combines qualities from all these categories, anomaly detection and misuse detection. The proposed mechanism not only takes the responsibility to collect and detect all of the desired information on each different stage, but also denotes specific clustering algorithm to indicate the significance of possible influence on each clustered data. All of the clustered data and detected normal/abnormal signals will be transferred to the database of the anomaly detection model for further integrated evaluation on those multiple observing factors based on hidden Markov model algorithm. The experimental results with the KDD Cup99 data sets demonstrate that the proposed IDS mechanism possesses good efficiency and has a high detection rate.