Network security situation assessment based on hidden semi-Markov model

Abstract

This paper takes use of the hidden semi-Markov model to evaluate network security situation. HsMM modifies HMM model on the presumption that certain system status dwell time abides with exponential distribution, which is more suitable to describe the actual situation of network system operation.We propose the HsMM system status prediction algorithm under partial observation conditions, and applies it into network security situation assessment. The ex-periment result shows that HsMM could model system status dwell time, so it is very propitious to make network system security assessment under complicated and changeable attacks. © 2011 Springer-Verlag.