使用协议分析和聚类支持向量机的入侵检测方法

Intrusion detection method using protocol analysis and clustering support vector machine

根据入侵检测中协议分析技术与聚类支持向量机各自不同的检测特点,将协议分析技术融合到聚类支持向量机中,提出了一种新的入侵检测方法.通过协议分析不但可以快速地检测出入侵行为,而且可以有效减少支持向量机的训练时间,同时结合聚类算法进一步减少支持向量机的训练时间和预测时间,从而提高聚类支持向量机的检测效率.使用KDD99中的数据集进行仿真,试验结果表明,算法具有可行性、有效性,能有效提高检测率,降低误报率.

Considering the altitudinal regularity of network protocol of data package,a new intrusion detection method was proposed.The protocol analysis technique was attached to the clustering support vector machine.It could take out the illegal data efficiently and reduce the sample training time.The experiment based on KDD99 shows that the method is better than the one that uses clustering support vector machine.