Adaptive intrusion prevention algorithm based on HMM Model

Intrusion prevention technologies and mechanisms have been developed to enhance the network security. Model-based approach is one of the most promising approaches for intrusion prevention and intrusion detection, since it can reveal the hidden characteristic of time series. Hidden Markov Model (HMM) is a main time series model. In the implement of the intrusion prevention mechanism, the combination of fast adaptive clustering algorithm and intrusion prevention algorithm is used to redetection, which can adaptively update model, and raise speed of detection. Experimental results with the KDD Cup99 data sets demonstrate that false positive rate of the detection algorithm is lower than conventional model-based detection algorithm, while the detection rate is still kept in a good state.