关键词: 隐马尔可夫模型, 复合攻击, 维特比算法, 攻击意图, 告警序列

Abstract: An approach of predicting multi-step attacks based on improved hidden Markov model (HMM) and Viterbi algorithm was proposed. When the training data was sparse, poor probability estimates of the HMM were obtained by using maximum likelihood estimation. Thus, a modified calculation method of probability matrix was used to reduce error. When there existed false alerts in the alert sequence, a decision threshold was introduced in the Viterbi algorithm for correcting the forecast results. From the simulation and the experimental results based on the DARPA2000 data set, it is concluded that the proposed method can effectively improve the predicting accuracy.

Key words: hidden Markov model, multi-step attacks, Viterbi algorithm, attack intent, alert sequence