一种基于核心向量机的分层入侵检测模型

A LAYERED INTRUSION DETECTION MODEL BASED ON CORE VECTOR MACHINE

近年来,网络攻击类型变得越来越复杂,传统的网络入侵检测模型仍然存在一些缺陷,难以正确分类每一种类型的攻击。提出一种基于核心向量机的分层网络入侵检测模型,第一个分类器和第二个分类器以数据集的特征作为输入,将网络流量分为攻击或正常。第三个分类器使用前两个分类器的输出和初始数据集的特征作为输入。该模型旨在正确分类每一种攻击并提供低误报率和高检测率。在NSL-KDD和UNSW-NB15数据集上进行实验,实验结果证明该模型提高了分类性能,与现有方法相比该模型在准确性、检测率、误报率和时间开销等方面具有竞争优势。

In recent years,the types of network attacks have become more and more complex,and there are still some defects in the traditional network intrusion detection model,which makes it difficult to correctly classify each type of attack.This paper proposes a hierarchical network intrusion detection model based on the core vector machine.The first classifier and the second classifier took the characteristics of the data set as input,and classified the network traffic into attack or normal.The third classifier used the output of the first two classifiers and the characteristics of the initial dataset as input.The model aimed to correctly classify each attack and provide a low false positive rate and a high detection rate.Experimental results on NSL-KDD and UNSW-NB15 data sets demonstrate that the proposed model improves classification performance and has competitive advantages in accuracy,detection rate,false positive rate and time cost,compared with existing methods.