基于协议分析和SVM多分类的入侵检测系统研究  

Intrusion detection system based on protocol analysis and SVM multi-classification

作　　者：段军[1] 林立友[2] 

机构地区：[1]内蒙古科技大学科技处,内蒙古包头014010 [2]内蒙古科技大学信息工程学院,内蒙古包头014010

出　　处：《内蒙古科技大学学报》2011年第1期56-60,共5页Journal of Inner Mongolia University of Science and Technology

摘　　要：入侵检测实质上可以被描述为对数据样本进行尽可能正确的分类,关键问题是特征选择和模式识别方法的选择.采用SVM分类器组合的方法对数据样本进行分类,结合协议分析技术,提出了基于协议分析和SVM多分类的入侵检测系统模型,并利用KDD CUP 99数据集对系统模型进行测试.测试结果表明,所提出的方法有效提高了入侵检测的效率,降低了漏报率和误报率.Intrusion detection can be essentially described as the classification of data samples as correctly as possible.The key problem is feature selection and choice of pattern recognition methods.The method of combined SVM classifiers was utilized to classify the data samples in combination with protocol analysis techniques.Intrusion detection system model was proposed based on protocol analysis and SVM multi-classification,and the system model was tested using KDD CUP 99data sets.The test result indicates that the method proposed in the experiment improves the efficiency of intrusion detection effectively and is able to reduce the failed report rate and false alarm rate.

关 键 词：入侵检测 协议分析 支持向量机 SVM多分类 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]