The application of Markov model Based Equivalence Class Generalization in network anomaly detection
Siyuan Peng, Guoyin Wang, Zhixing Li, Jie ming Yang · 2017
Normal network behavior is in line with some certain rules of grammar, while abnormal behavior will deviate from the normal grammar rules. Markov model is generally used to train the normal grammatical structures. However, the structures of grammar maybe change with the website is updated, which results in the zero probability problem. In this paper, we proposed a new method combined with N-Gram model and Equivalence class to improve the generalization ability of the traditional Markov model to solve the zero probability problem. The Markov model Based on Equivalence Class Generalization achieved a better performance in the experiments of real data.