基于决策SVM的入侵检测技术研究

Research on intrusion detection technology based on SVM-decision tree

在网络入侵检测中,数据类别不均衡训练集的使用将产生分类偏差,支持向量机是一种新型的统计学习模型,在处理小样本和学习机的推广能力上有很大的优势.针对支持向量机解决k个多类分类问题存在训练样本数据大、训练困难的问题,提出基于支持向量机的决策树训练算法,构建了基于支持向量机决策树的入侵检测系统模型.利用KDDCup99数据集,将本文提出的算法与Lee-Carter方法和1-v-R方法进行了对比实验.通过实验和比较表明,该方法的训练效率大大提高,并且具有较高的检测率.

In the process of network intrusion detection, the usage of training sets with uneven class sizes will result in classification biases. Support vector machine（SVM） is a new statistical learning model, and it has great advantages in small sample and machine generalization ability. Considering the problems of larger training samples and training difficult by using SVM to disposal the multi-class classification, this paper proposed the SVM- decision tree multi-category classification training algorithm, and gave a network intrusion detection model based on SVMDT. Moreover, it compared the result from KDD Cup99 dataset and that of from ＂Lee-Carter＂ and ＂1-v- R＂. Experiment results show that the method greatly improves the efficiency of the training, and has a higher detection rate.