Improved HMM model based method for detecting cyber attacks
Jingyu Yang · Journal of Communications · 2010
An improved HMM model based method for detecting cyber attacks was proposed. Normal network behaviors followed a regular grammar, while anomalies deviated the normal grammar. Grammar model represented by HMM model trained with normal network behavior samples easily distinguished normal and malicious requests by their contrasting conforming degrees. A significantly improved performance was achieved in real data tests compared with other anomaly methods.