In the invading testing, the testing of unknown is mainly accomplished by the abnormal testing. Traditional abnormal testing methods need to construct a normal behavior feature outline reference mode. When establish this mode, it is needed to have large amount of pure normal data set, and this data set usually is not easy to gain from the real network. Whats worse, the problem of too much error reports and leaking reports in the abnormal testing is pervasive. In order to overcome this shortage, this paper rises a abnormal testing method which is combine clustering analysis and HMM. This method doesnt need any training data set of manual marking; it can explore many different types of invading behaviors. The experimental results indicate that this method has better effect on the testing, which is of a higher testing rate and lower error report rate.
Read full abstract