基于稀疏编码和SVM的协同入侵检测

Cooperative intrusion detection system based on sparse coding and support vector machine

将稀疏编码理论应用于入侵检测,并提出一种将稀疏编码理论和支持向量机结合的入侵检测算法。稀疏性约束同时引入到过完备词典学习和编码过程,学习到的系数作为特征送入到支持向量机进行入侵检测。实验表明,稀疏性具有一定的去噪能力,使得学习的特征更富有判别力。同时实验也验证了所提出的方法能保证较高的检测率和较低的误报率,并且对不平衡数据集有较好的鲁棒性。

The theory of sparse representation is applied to intrusion detection, and an approach based on sparse coding and support vector machine is also proposed for intrusion detection. Sparsity constraints are added to train the over-complete dictionary and encode samples simultaneously. Learned sparse coefficients as features are ted into support vector machine for intrusion detection. Experiments show that the sparsity can remove some noises and make mapping features more discriminative. Meanwhile, experiments also prove our proposed method more effective with higher detection rate and lower ialse alarm rate, especially good robustness in the imbalanced dataset experiment.