Intrusion intension recognition system and method based on hidden markov and probability inference

Abstract

The invention discloses an intrusion intension recognition system and method based on hidden markov and probability inference, and belongs to the technical field of computer security. The method comprises the steps that firstly, due to the causal relationship existing among attack events, subgoals and intentions, a hierarchical bayesian network (HBN) is built for representing the causal relationship between the layers; secondly, the subgoals have the obvious time-order characteristics, and the hidden relationship for a target layer and an intention layer is learned based on a hidden markov model (HMM); finally, a multi-output hidden markov model (MO_HMM), a loop believable propagation algorithm (LBP) is introduced for optimizing the problem of single-probability output of a forward algorithm and a backward algorithm in HMM, and a plurality of possible intentions and probability can be reported.

Description

technical field [0001] The invention belongs to the technical field of computer security, and relates to intrusion intent identification, in particular to an intrusion intent identification method based on time series relationship and uncertainty information. Background technique [0002] With the development of computer networks, the amount of data increases exponentially. The data storage and network access methods in the big data environment make the cost of network attacks lower and the income higher. Existing intrusion intent identification methods are difficult to simulate real attack scenarios, and then effectively identify and predict their intent. Therefore, it is necessary to seek the hidden causal relationship behind a large number of attack events, and extract the attack intention based on the attack direction. [0003] Effectively extracting and predicting the attacker's attack intention is the key to effectively assessing security situation awareness. In rec...

AI Technical Summary

Problems solved by technology

Although most of the methods consider the causal relationship between the attack steps of the compound attack, they ignore the time and space relationship between the two attacks.

Images