基于阈值优化的CDRM-SVM入侵检测算法  

Intrusion detection algorithm based on CDRM-SVM with optimized threshold

作　　者：陈振国[1] 李冬艳[1] 耿子林[1] 

机构地区：[1]华北科技学院计算机系,三河065201

出　　处：《东南大学学报（自然科学版）》2008年第A01期68-72,共5页Journal of Southeast University：Natural Science Edition

基　　金：华北科技学院校内基金资助项目(2008-B-12)

摘　　要：为了提高中心距离比值法预选取支撑矢量的效率,降低支撑矢量机的训练时间,引入自适应动态克隆算法对中心距离比值法的阈值进行优化,并将该算法应用于入侵检测中,提出了基于阈值优化的CDRM-SVM入侵检测算法.算法首先利用自适应动态克隆算法对中心距离比值法中的阈值进行优化,获得理想的阈值,从而可以提取出包含全部支撑矢量的边界矢量集,然后使用边界矢量集代替训练样本集进行支持矢量机的训练,大幅度减少了训练样本的数量,使支持矢量机的训练速度显著提高.同时,由于边界矢量集中包含了支撑矢量,因此,支撑矢量机的分类能力没有受到影响.采用KDDCUP 99数据集进行试验,试验结果表明:与传统方法相比,在保证性能的情况下,所提算法能够有效地降低支持向量机的训练时间.To improve the efficiency of support vector extraction using center distance ratio method （CDRM） and reduce the training time of support vector machine （SVM）, the adaptive dynamic clone selection algorithms is introduced and used to optimize the threshold in center distance ratio method. Then, the algorithm is used in intrusion detection and the intrusion detection algorithm based on CDRM-SVM with optimized threshold is proposed. First, the threshold is optimized by the adaptive dynamic clone selection algorithm and a perfect threshold is obtained. Thereby the border vectors set including all of support vector is extracted. Then SVM is trained by substituting the border vector set for training set. The method reduces training samples greatly and advances training speed markedly. The classification capability of support vector machines is not affected because the border vectors contain support vectors. Experimental results using the knowledge discovery and data mining cup 1999 （KDDCUP99） datasets indicate that the improved algorithm reduces the training time of SVM effectively comparing with the conventional method under the same detection performance condition.

关 键 词：入侵检测 克隆选择 支撑矢量 中心距离比值 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]