Abstract:Currently, hidden Markov-based multi-step attack detection models are mainly trained using the unsupervised Baum–Welch algorithm. The Baum–Welch algorithm is sensitive to the initial values of model parameters. However, its training uses random or average parameter initialization methods, which frequently results in the model training into a local optimum, thus, making the model unable to fit the alert logs well and thereby reducing the detection effectiveness of the model. To solve this issue, we propose a pre-training method for multi-step attack detection models based on the high semantic similarity of alerts in the same attack phase. The method first clusters the alerts based on their semantic information and pre-classifies the attack phase to which each alert belongs. Then, the distance of the alert vector to each attack stage is converted into the probability of generating alerts in each attack stage, replacing the initial value of Baum–Welch. The effectiveness of the proposed method is evaluated using the DARPA 2000 dataset, DEFCON21 CTF dataset, and ISCXIDS 2012 dataset. The experimental results show that the hidden Markov multi-step attack detection method based on pre-training of the proposed model parameters had higher detection accuracy than the Baum–Welch-based, K-means-based, and transfer learning differential evolution-based hidden Markov multi-step attack detection methods.

HMM Algorithm Base on Clustering and Application in NIDS

NIDS: Neural Network Based Intrusion Detection System

Multi-agent based hybrid Intrusion detection system

An Unsupervised Anomaly Detection Approach Using Subtractive Clustering And Hidden Markov Model

The Pattern Recognition of Non-Destructive Testing Based on HMM

Anomaly Detection Technique Based on Hidden Markov Model

HMMs (Hidden Markov models) based on anomaly intrusion detection method

Modeling program behaviors by hidden Markov models for intrusion detection

Hidden Semi-Markov Model for Anomaly Detection

An Intrusion Detection of Anomalous Based on HMM System Call Sequence

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

Anomaly detection method based on HMMs using system call and call stack information

An Anomaly Detection Model Based on Dynamic Behavior and Character Patterns

Clustering of Network Link Characteristic for Detector Placement of Macroscopical Prewarning

A hybrid unsupervised clustering-based anomaly detection method

CLUSTERING-BASED NETWORK INTRUSION DETECTION

Non-intrusive load monitoring using factorial hidden markov model based on adaptive density peak clustering

Building an Effective Intrusion Detection System Using the Modified Density Peak Clustering Algorithm and Deep Belief Networks

Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models

A New Anomaly Detection Method Based on Rough Set Reduction and HMM

Hybrid Intrusion Detection Method Based on CM-K-Means