基于支持向量机的入侵检测系统

An Intrusion Detection System Based on Support Vector Machine

目前的入侵检测系统存在着在先验知识较少的情况下推广能力差的问题.在入侵检测系统中应用支持向量机算法,使得入侵检测系统在小样本(先验知识少)的条件下仍然具有良好的推广能力.首先介绍入侵检测研究的发展概况和支持向量机的分类算法,接着提出了基于支持向量机的入侵检测模型,然后以系统调用执行迹(system call trace)这类常用的入侵检测数据为例,详细讨论了该模型的工作过程,最后将计算机仿真结果与其他检测方法进行了比较.通过实验和比较发现,基于支持向量机的入侵检测系统不但所需要的先验知识远远小于其他方法,而且当检测性能相同时,该系统的训练时间将会缩短.

The generalizing ability of current IDS (intrusion detection system) is poor when given less priori knowledge. Utilizing SVM (support vector machines) in Intrusion Detection, the generalizing ability of IDS is still good when the sample size is small (less priori knowledge). First, the research progress of intrusion detection is recalled and algorithm of support vector machine taxonomy is introduced. Then the model of an Intrusion Detection System based on support vector machine is presented. An example using system call trace data, which is usually used in intrusion detection, is given to illustrate the performance of this model. Finally, comparison of detection ability between the above detection method and others is given. It is found that the IDS based on SVM needs less priori knowledge than other methods and can shorten the training time under the same detection performance condition.