基于S-SVM的大规模网络行为异常检测

Sparse Support Vector Machine-based Large-scale Network Behavior Anomaly Detection

现阶段针对大规模网络行为数据的入侵检测技术主要以数据挖掘技术为重要趋势,较有代表性的工作之一有采用支持向量机来抽取网络数据的特征,建立入侵检测模型。针对网络行为数据集的稀疏性,可以采用由"l1范数"而得到的稀疏支持向量机算法,对网络行为数据集进行特征提取和分类。通过引入列生成和约束生成算法对S-SVM的模型进行求解,最后利用HTTP DATASET CSIC 2010数据集进行实验,验证了此类稀疏支持向量机算法在大规模网络行为异常检测中的可行性和准确性。

At present, the intrusion detection technology for large-scale network behavior data mainly takes data mining technology as an important trend. One of the more representative works is the use of support vector machine to extract the characteristics of network data and establish an intrusion detection model. In view of the sparsity of network behavior data set, the sparse support vector machine algorithm based on "l1 norm" can be used to extract and classify the features of network behavior data set. The model of S-SVM is solved by introducing column generation and constraint generation algorithms. Finally, the experiments with HTTP DATASET CSIC 2010 data set indicate the feasibility and accuracy of this kind of sparse support vector machine algorithm in large-scale network behavior anomaly detection.