Abstract: An approach of predicting multi-step attacks based on improved hidden Markov model (HMM) and Viterbi algorithm was proposed. When the training data was sparse, poor probability estimates of the HMM were obtained by using maximum likelihood estimation. Thus, a modified calculation method of probability matrix was used to reduce error. When there existed false alerts in the alert sequence, a decision threshold was introduced in the Viterbi algorithm for correcting the forecast results. From the simulation and the experimental results based on the DARPA2000 data set, it is concluded that the proposed method can effectively improve the predicting accuracy.

Key words: hidden Markov model, multi-step attacks, Viterbi algorithm, attack intent, alert sequence