基于SVM的入侵检测系统  

SVM-based Intrusion Detection System

作　　者：钱权[1] 耿焕同[2] 王煦法[2] 

机构地区：[1]上海大学计算机学院,上海200072 [2]中国科学技术大学计算机科学系,合肥230027

出　　处：《计算机工程》2006年第9期136-138,共3页Computer Engineering

基　　金：国家自然科学基金资助项目(90104030);面向21世纪教育振兴行动计划基金资助项目

摘　　要：支持向量机(SVM)作为一种新型的统计学习模型,在处理小样本和学习机的推广能力上具有很大的优势。该文应用SVM的分类特性来识别网络攻击行为,提出了基于SVM的入侵检测方法。重点考察了不同SVM核函数和参数选择对检测准确率和实时性的影响。论证了基于SVM的入侵检测在性能和识别率上都明显优于基于BP网络的攻击识别,还就目前商用入侵检测系统存在较高误报率的问题,分析了用SVM来提高其检测实时性和识别准确率的系统框架。Support vector machine, as a new statistical learning model, possesses great advantages in small sample and ,naehine generalization ability. Tbis paper utilizes the classification feature of SVM to recognize intrusion, and gives SVM-based intrusion detection system. It focuses heavily oil detection correctness and pertbrmance as to different SVM kernel functions and other parameters. Meanwhile, as to BP-based intrusion detection, SVM-based intrusion detection shows great advantages in detection correctness and performance, which is demonstrated. Moreover, the hybrid system framework using SVM to improve the detection correctness and performance is also proposed in the end of the paper, which aims at solving the main problem, high false positives of the current commercial IDS.

关 键 词：支持向量机 统计学习模型 入侵检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]