A Real-time Security Assessment Algorithm Based on HMM
Yanli Wang · Harbin Ligong Daxue xuebao · 2008
Current risk assessment methodologies focus on manual risk analysis of networks during system design or through periodic reviews.Most existing approaches are not suitable for real-time use.In this paper,we introduce an approach to network security assessment which is based on Hidden Markov Models to improve the ability of real-time.The benefit of our approach is the ability to enable the assessment of risk building upon existing network monitoring and intrusion detection systems,both on a system-wide level,as well as for individual objects.We assume a multiagent system architecture,can know hidden security status according to the observations sequence,every agent receive and process the observations provided by the sensors,and the information system or network security is dynamically evaluated based on these data.Finally,the approach is evaluated using real-life data,to illustrate its feasibility and high real-time capability.