A novel hidden Markov model for detecting complicate network attacks

Abstract

It is difficult to detect complicate network attacks effectively nowadays. To detect these attacks the inherent characteristics of complicate network attacks are analyzed in detail. A novel hidden Markov model is proposed. The model is composed of several different monitors. In order to simplify the training procedure of the model and to improve its response performance warning events are classified into different types at first. Then the sequences of warning event types from different network monitors are correlated and their inherent relationship is mined so as to detect the type of complicate network attacks and to forecast their threat degree to the system. The experimental results show that the proposed model could recognize complicate network attacks effectively.