应用支持向量机实现计算机入侵检测

Detecting intrusions by using support vector machines

介绍入侵检测的概况和支持向量机的基本概念和工作原理,提出了应用支持向量机进行异常入侵检测的工作过程,并以程序执行迹为数据源给出了应用支持向量机进行入侵检测的性能.该结果显示出在先验知识,即训练样本数少的条件下,该方法仍能达到较为满意的效果.

The most common technology used in intrusion detection are anomaly detection technology and misuse detection technology, both of which are based on the mass prior knowledge. When given less prior knowledge, the performance of both techniques can not meet our need. Because SVM solves the small samples learning problem well, it will get good performance using SVM in intrusion detection, given less knowledge. A survey of intrusion detection is described and the basic concepts about SVM are introduced. The procedure of detection intrusions using SVM are discussed in detail. Finally, the experiment was performed on system call trace. The result shows that its performance is still good when given less prior knowledge.