Situation prediction method based on joint hidden Markov model and genetic algorithm

Abstract

The invention discloses a situation prediction method based on a joint hidden Markov model and a genetic algorithm. According to the method, an artificial fish swarm algorithm is used for optimizing afuzzy clustering method to process redundant alarms and false alarms, the artificial fish swarm algorithm can well overcome the defect that fuzzy c-means clustering is sensitive to an initial clustering center, and therefore the purpose of optimizing the alarm clustering precision is achieved. Meanwhile, aiming at the problem that the training result is locally optimal due to improper setting ofinitial parameters in the training process of the hidden Markov model, a clustered alarm is used as input; a genetic algorithm is used for optimizing an initial value of the hidden Markov model, thena Boehmie algorithm is used for further training optimized parameters, finally hidden Markov model parameters under maximum likelihood estimation are obtained, and a Viterbi algorithm is combined withobserved values to predict the security situation. The method can improve the accuracy of network security situation prediction.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to a situation prediction method based on a joint hidden Markov model and a genetic algorithm. Background technique [0002] With the development of Internet technology, it carries more and more services. Electricity, water conservancy, communications, banking, transportation, education, military, etc. are all inseparable from the Internet. All kinds of businesses carried on the Internet and all kinds of information stored are the embodiment of physical reality value. The emergence of Bitcoin has further blurred the boundary between the virtual network world and the real world. The information in the online world is huge and complex. The free, convenient, and fast access to the Internet makes people all over the world use the Internet without being restricted by time and place, and thus network security has attracted more and more attention. In recent ye...

AI Technical Summary

Problems solved by technology

[0004] Existing clustering methods are sensitive to initial cluster centers when applied to intrusion detection alarm processing, which makes the analysis of alarm results inaccurate

Thus affecting the training of the final model, the accurate model cannot be obtained very well

[0005] Due to the inherent defects of the hidden Markov model itself, it is easy to lead to the selection standard defect of the initial value when using the EM algorithm for training, which makes the selection of the initial value poor, resulting in a local optimal training result

Images