关键词: 异常检测, 隐半马尔可夫模型, BSM审计数据, 特权流

Abstract: A host oriented anomaly detection system framework based on hidden semi-Markov model is given.BSM audit data are used as research data sources.Firstly select the privilege flow system calls series of the normal host behavior.Then the normal behavior of computer is modeled using HSMM.Then by comparing the current computer behavior with the model，we can determine whether the current behavior is normal.This paper selects the privilege flow events of BSM audit data as the research target so as to shorten the time of modeling to some extent and improve detection performance as well by filtering useless data.The experiment result reveals that the proposed method is better than HMM method，for the former not only can shorten the training time but also decrease false-positive error while increasing detection rate.

Key words: anomaly detection, hidden semi-Markov model, BSM audit data, privilege flow