改进的增量式SVM在网络入侵检测中的应用

Improved incremental SVM and application in network intrusion detection

针对传统的增量式支持向量机（Incremental Support Vector Machine,ISVM）在处理数据集时易受数据噪声和学习过程中振荡问题影响的缺点,将改进的核函数U-RBF和构造备用集的同心圆方法相结合,提出了基于备用集的增量式支持向量机（Reserved Set-Incremental Support Vector Machine,RS-ISVM）方法。该方法首先将特征属性的均值和均方差值嵌入到核函数RBF中,并通过同心圆方法将后续学习过程中最有可能成为支持向量的样本划入备用集。入侵检测实验证明RS-ISVM能够降低学习过程的振荡现象,提高了学习的速度,有非常好的性能和可靠性。

Due to the shortcomings of data noise and the learning process’s oscillation problem when traditional incremental support vector machine deals with data samples, an incremental SVM based on reserved set is proposed, which combines modified kernel function with concentric circle method to structure the reserved set. The proposed method embeds the mean and mean square difference values of feature attributes in kernel function RBF. In order to shorten the training time, a concentric circle method is suggested to be used in selecting samples to form the reserved set. The intrusion detection experiments show that RS-ISVM can ease the oscillation phenomenon in the learning process and achieve pretty good performance, meanwhile, its reliability is relative high.