針對(duì)入侵檢測(cè)中普遍存在誤報(bào)與漏報(bào)過(guò)高的問(wèn)題，本文提出一種新的基于隱馬爾可夫模型的系統(tǒng)入侵檢測(cè)方法。該方法以程序正常執(zhí)行過(guò)程中產(chǎn)生的系統(tǒng)調(diào)用序列為研究對(duì)象，首先建立計(jì)算機(jī)運(yùn)行狀況的隱馬爾可夫模型，然后在此模型的基礎(chǔ)上提出一個(gè)用于計(jì)算機(jī)系統(tǒng)實(shí)時(shí)異常檢測(cè)的算法。實(shí)驗(yàn)證明，用這種方法建模的系統(tǒng)在不影響檢測(cè)率的情況下，比傳統(tǒng)的數(shù)據(jù)建設(shè)模節(jié)省存儲(chǔ)空間，并且準(zhǔn)確率高。
關(guān)鍵詞：入侵檢測(cè)；異常檢測(cè)；隱馬爾可夫模型（HMM）
Abstract: To solving the problem of high ratio of false alarm and self- adaptation,
this paper proposes a new method to network intrusion detection based on HMM
model. This method first research the system call serial in the normal application of
the program to found a HMM for the normal behavior of computer system and to
bring forward an algorithm of anomaly detection. It is proved that this method
increases the rate of accuracy and save more storage space without affecting the
detection rate.
Keywords: intrusion detection; anomaly detection; hidden markov model(HMM)