基于One-class SVM的实时入侵检测系统  

A Real-time Intrusion Detection System Based on One-class SVM

作　　者：黄谦[1] 王震[1] 韦韬[1] 陈昱[1] 

机构地区：[1]北京大学计算机科学技术研究所,北京100871

出　　处：《计算机工程》2006年第16期127-129,共3页Computer Engineering

摘　　要：将One-class支持向量机和Online训练算法应用于入侵检测研究中,把入侵检测看作是一种单值分类问题,能够在有噪声的数据集中进行训练,降低了对训练集的要求,提高了检测准确性。同时解决了基于SVM的入侵检测系统实时训练的问题,在实际运用中可以实时地添加新的训练样本对新出现的攻击手段进行分类。在KDDCUP'99标准入侵检测数据集上进行实验,系统缩短了训练时间并且获得了较高的检测准确率。This paper presents an algorithm for intrusion detection, based on one-class support vector machine （SVM） and online training of SVM. The algorithm formulates intrusion detection as a one-class classification problem. The model-building part of the algorithm works even when the training data is noisy, and therefore compared with regular SVM algorithms, it imposes fewer requirements on the training set and has a higher detection rate. For the testing data containing new types of attack, the algorithm can add such data to the training set and update the training result real-time. It tests the algorithm on KDD CUP＇ 99 benchmark data set for intrusion detection and the result shows that the algorithm is able to shorten the training time, and in the same time, obtain a high detection rate.

关 键 词：信息安全 入侵检测 支持向量机 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]