基于SVM和D-S证据理论的入侵检测方法

Intrusion detection based on SVM and D-S evidence theory

以D-S证据理论为基础,提出了一种基于支持向量机(SVM)分类器的入侵检测系统模型。根据TCP基本特征、内容特征和流量特征,采用3个SVM分类器对网络连接分类,将分类结果作为证据,利用D-S合成法则对分类输出进行融合和检测。实验表明,文中所提出的方法在入侵检测系统中的应用能有效降低误报率和漏报率,显著提高检测正确率。

Based on D-S evidence theory, a new IDS model using Support Vector Machine （SVM） classifiers is presented. According to TCP basic, content and flow features, we apply the three SVM to classify the network connections, and detect the output with the classified results and D-S combination theorem. The experimental result shows that the method can effectively decrease the false report rate and increase the accuracy.