基于T检验和特征项目分析的入侵检测研究

Intrusion Detection Based on T-test and Characteristic Analysis

在入侵检测中,部分TCP连接的特征对入侵检测没有帮助,反而影响了检测的速度和性能。因此,本文提出使用独立样本T检验的方法对TCP连接的特征进行分析,删除那些不具有区分特性的特征项目。对DAR-PA KDD CUP 99的入侵检测数据分析之后,发现在41个特征中仅有30个特征对入侵检测有用,其他11个特征是冗余的。用支持向量机进行检测的结果表明,应用30个特征比应用41个特征进行检测的效果和速度更好。

Some features of the TCP connection are useless in the intrusion detection speed and accuracy. In order to select intrusion detection, and what is more ,they lower the useful TCP connection features, T-tests of independent samples are utilized to analyze the items of characteristics. The features that cannot be used to distinguish the normal connection and the intrusion connection are deleted in detection. By analysing DARPA KDD CUP99 dataset, it is found that only 30 out of 41 features are useful for intrusion detection. Through the SVM based intrusion detection method, it is shown that the results of using 30 features are better than using 41 features.