A new anomaly detection method based on hierarchical HMM

by: Xiaoqiang Zhang, Pingzhi Fan, Zhongliang Zhu

Parallel and Distributed Computing, Applications and Technologies, 2003. PDCAT'2003. Proceedings of the Fourth International Conference on (2003), pp. 249-252.

View FullText article

http://ieeexplore.ieee.org/xpls/abs_all.j…

Reviews [Write a review of this article]

There are no reviews of this article

Find related articles from these CiteULike users

sunniesheu

Find related articles with these CiteULike tags

intrusion_detection, markov

Abstract

The state transition, which is hidden in the hidden Markov model (HMM), can be used to characterize the intrinsic difference between normal action and intrusion behavior. So HMM is an efficient way to detect anomalies. A new anomaly detection method based on a hierarchical HMM is proposed based on the concept of normal database and abnormal database. It is shown by analysis and simulation results that the proposed method is effective to increase the accuracy of anomaly detection.

@inproceedings{citeulike:363241, abstract = {The state transition, which is hidden in the hidden Markov model (HMM), can be used to characterize the intrinsic difference between normal action and intrusion behavior. So HMM is an efficient way to detect anomalies. A new anomaly detection method based on a hierarchical HMM is proposed based on the concept of normal database and abnormal database. It is shown by analysis and simulation results that the proposed method is effective to increase the accuracy of anomaly detection.}, author = {Zhang, Xiaoqiang and Fan, Pingzhi and Zhu, Zhongliang }, citeulike-article-id = {365131}, journal = {Parallel and Distributed Computing, Applications and Technologies, 2003. PDCAT'2003. Proceedings of the Fourth International Conference on}, keywords = {intrusion\_detection, markov}, pages = {249--252}, posted-at = {2005-10-26 05:16:10}, priority = {2}, title = {A new anomaly detection method based on hierarchical HMM}, url = {http://ieeexplore.ieee.org/xpls/abs\_all.jsp?arnumber=1236299}, year = {2003} }

RIS record

TY - CONF ID - citeulike:363241 L3 - citeulike-article-id:365131 N2 - The state transition, which is hidden in the hidden Markov model (HMM), can be used to characterize the intrinsic difference between normal action and intrusion behavior. So HMM is an efficient way to detect anomalies. A new anomaly detection method based on a hierarchical HMM is proposed based on the concept of normal database and abnormal database. It is shown by analysis and simulation results that the proposed method is effective to increase the accuracy of anomaly detection. JF - Parallel and Distributed Computing, Applications and Technologies, 2003. PDCAT'2003. Proceedings of the Fourth International Conference on EP - 252 TI - A new anomaly detection method based on hierarchical HMM SP - 249 KW - intrusion_detection KW - markov AU - Zhang, Xiaoqiang AU - Fan, Pingzhi AU - Zhu, Zhongliang PY - 2003/// UR - http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1236299 ER -

RIS BibTeX