基于随机子空间PCA-SVM集成的实时入侵检测系统  

Real-time intrusion detection system base on random subspace PCA-SVM ensemble

作　　者：张红梅[1] 

机构地区：[1]认知无线电与信息处理省部共建教育部重点实验室(桂林电子科技大学),桂林541004

出　　处：《仪器仪表学报》2009年第12期2680-2684,共5页Chinese Journal of Scientific Instrument

基　　金：广西区科学基金(桂科青0728091)资助项目

摘　　要：为了解决入侵检测系统的检测精度低、虚警率高的问题,实现了一个基于网络的入侵检测实验平台,使用了多种新的攻击工具实施攻击,并在此基础上提取了网络连接的29项实时特征;构成实时入侵检测数据集;同时,提出了一个基于随机子空间PCA的Bagging-SVM分类器集成构造方法,并将其应用到所采集的实时入侵检测数据集,构造网络连接的检测器。经实验表明,所选取的网络连接特征能较好地反映网络安全状况,所采用的集成学习算法具有检测精度高、检测稳定、对基分类器的参数整定不敏感等优点。In order to solve the problem of low accuracy and high false alarm existing in current intrusion detection system, a network based intrusion detection platform has been established and many up-to-date attack tools are used to attack the network. On the basis of intrusion experiments, 29 variables are chosen as intrusion features to form a real-time intrusion detection dataset. At the same time, a construction method of SVM Bagging ensemble based on random subspace PCA （principle component analysis） is proposed. The collected real-time intrusion detection dataset is applied to get a network connection detector. Experimental results indicate that the features extracted from network connections are good indicators of the status of the network and the ensemble learning algorithm bears the merits of high detection rate, stable and not sensitive to parameter setting.

关 键 词：PCA SVM Bagging集成 入侵检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]