基于支持向量机的网络入侵检测

Network Intrusion Detection Based on Support Vector Machine

将统计学习理论引入入侵检测研究中 ,提出了一种基于支持向量机的入侵检测方法 (SVM BasedID) 针对入侵检测所获得的高维小样本异构数据集 ,将SVM算法在这种异构数据集上进行推广 ,构造了基于异构数据集上HVDM距离定义的RBF形核函数 ,并基于这种核函数将有监督的C SVM算法和无监督One ClassSVM算法用于网络连接信息数据中的攻击检测和异常发现 ,通过对DARPA数据的检测试验结果表明提出的方法是可行的。

Statistical learning theory (SLT) is introduced to intrusion detection (ID) and an ID method based upon support vector machine (SVM) is presented in this paper. The SVM algorithm is generalized for high dimensional and heterogeneous datasets acquired in ID and a new RBF kernel function is developed based on HVDM distance metric of heterogeneous datasets. Supervised C-SVM and unsupervised One-Class SVM algorithms utilizing kernel function are applied in detecting the intrusions hidden in the network connection records. The testing results on the DARPA data show that the method is effective and efficient.