COMBINING THE HMM AND THE NEURAL NETWORK MQDELS TO RECOGNIZE INTRUSIONS
Xiao-Qung Zhang, Zhong-Llang Zhu · 2004
he to the excellent performance of the HMM (Hidden Markov Model) in paprn recognition, it has been widely used in voice recognition, text-recognition. In recent years, the HMM has also been applied to the intrusion detection. The intrusion detection method based on the HMM is more effiaent than other methods. The HMM based intrusion detection method is composed by two processes: one is the HMM process; the other is the hard decision process, which Is based on the profde database. Because of the dynamical behavior of system calls, the hard decision pmcess based on the prome database cannot be efficient to detect novel intrusions. On the other band, the profide database will consume many computer resources. For these reasons, the combined detection method was provided in this paper. The neural network is a kind of artiticial intelligence tools and is combined with the HMM to make soft decision. In the implementation, radial basis function model is used, because of its simplicity and its flexibility to adapt pattern changes. With the soft decision based on the neural network, the robustness and accnrate rate of detection model are greatly impmved. The efficiency of this method has been evalnated by the data set originated from New Mexico University.