基于支持向量机的Windows主机入侵检测系统  

Windows-Hosted Intrusion Detection System Based on Support Vector Machines

作　　者：张雪芹[1] 顾春华[1] 林家骏[1] 

机构地区：[1]华东理工大学信息科学与工程学院,上海200237

出　　处：《华东理工大学学报（自然科学版）》2006年第3期341-345,共5页Journal of East China University of Science and Technology

摘　　要：提出了一种基于支持向量机的W indow s主机入侵检测方法。讨论了以W indow s注册表作为数据源的入侵检测系统的结构及特征向量的提取方法。给出了基于支持向量机的入侵分类算法,通过建立支持向量描述模型进行预测。实验表明:该方法对已知样本有很高的检测率,对未知样本也有一定检测能力。A Windows-hosted intrusion detection system（IDS） based on support vector machines is presented. The framework and the feature vector selection methods of the IDS in which the Windows registry is used as data source are discussed. The intrusion classification algorithm based on support vector machines is proposed and the support vector machines model is built. Experiments show that this algorithm has high detection precision for known samples and can also detect intrusion for some unknown samples.

关 键 词：异常检测 WINDOWS注册表 支持向量机 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]