为了克服隐马尔可夫模型(hiddenMarkovmodel,HMM)在训练时波氏算法(Baum-Welch,B-W)易陷入局部最优解的不足,采用自适应遗传算法对其进行参数优化,设计了染色体编码方法和遗传操作方式。利用Viterbi算法选择最有可能的元证据序列,用疑似证据替换元证据回溯得到证据链。实验结果表明,自适应遗传算法优化的HMM具有更好的状态,采用Viterbi算法得到的证据链能够较精确地重现网络入侵的犯罪现场。
For overcoming the deficiency that the Baum-Welch ( B-W) algorithm is easy to fall into local optima solution, this paper used an adaptive genetic algorithm to estimate parameters of the hidden Markov model (HMM) , and designed chromosome coding method and genetic operation mode. Then, it used the Viterbi algorithm to acquire the most likely sequence of meta evidence. And it replaced the meta evidence with suspected evidence, thus obtained the chain of evidence. The experimental results show that, compared with the network forensics evidence fusion method which is based on the HMM, this method can accurately reproduce the crime scene of network intrusion.