基于半监督学习的入侵检测系统

Semi-Supervised Learning-Based Network Intrusion Detection System

在入侵检测方法中,半监督学习作为一种特殊的学习形式,结合了监督学习与非监督学习在检测已知模式数据与未知模式数据方面各自的优点。据此,为进一步提高入侵检测系统的检测准确性,提出一种结合SVM与KMO(online k-means)算法各自优点的半监督入侵检测模型。该模型首先利用SVM算法对全部的输入数据进行区分,然后将其认为的合法数据集用KMO算法分类,以该结果作为决策模块的输入并做出最终的响应。实验显示,文中模型比单独使用其中的任一种方法具有更高的检测准确率。由此可见,该模型对于实际的入侵检测系统具有实用价值。

In the intrusion detection method, semi-supervised learning as a special form of learning, combines the advantages of supervised learning and unsupervised learning in detecting the known and unknown mode of data. Accordingly, to improve the detection accuracy, proposed a semisupervised intrusion detection model that integrates the respective advantages of SVM and KMO （ online k-means）. In this model,firstly use the SVM algorithm to filter all the input data, then the considered legitimate data is classified with KMO, so the decision-making module can respond the final input data. Experiments show that the model has a higher detection accuracy than use each of them alone. Thus, the model has practical value for real intrusion detection system.