A Situation Prediction Method Based on Joint Hidden Markov Model and Genetic Algorithm

Abstract

A situation prediction method based on the joint hidden Markov model and genetic algorithm. This method uses the artificial fish swarm algorithm to optimize the fuzzy clustering method to deal with redundant alarms and false alarms. The artificial fish swarm algorithm can well overcome the fuzzy c-means Clustering is sensitive to the initial cluster center, so as to achieve the purpose of optimizing the alarm clustering accuracy. At the same time, in order to solve the problem that the improper setting of the initial parameters of the hidden Markov model in the training process will easily lead to the local optimum of the training results, the alarm after clustering is used as input, and the genetic algorithm is used to optimize the initial value of the hidden Markov model. The Baum Welch algorithm is used to further train the optimized parameters, and finally the parameters of the hidden Markov model under the maximum likelihood estimation are obtained, and the Viterbi algorithm is combined with the observed values ​​to predict the security situation. This method can improve the accuracy of network security situation prediction.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to a situation prediction method based on a joint hidden Markov model and a genetic algorithm. Background technique [0002] With the development of Internet technology, it carries more and more services. Electricity, water conservancy, communications, banking, transportation, education, military, etc. are all inseparable from the Internet. All kinds of businesses carried on the Internet and all kinds of information stored are the embodiment of physical reality value. The emergence of Bitcoin has further blurred the boundary between the virtual network world and the real world. The information in the online world is huge and complicated. The free, convenient, and fast access to the Internet makes people all over the world use the Internet without being restricted by time and place, and thus network security has attracted more and more attention. In recen...

AI Technical Summary

Problems solved by technology

[0004] Existing clustering methods are sensitive to initial cluster centers when applied to intrusion detection alarm processing, which makes the analysis of alarm results inaccurate

Thus affecting the training of the final model, the accurate model cannot be obtained very well

[0005] Due to the inherent defects of the hidden Markov model itself, it is easy to lead to the selection standard defect of the initial value when using the EM algorithm for training, which makes the selection of the initial value poor, resulting in a local optimal training result

Images