属性约减与分类器融合实时入侵检测研究  

Real-time intrusion detection system of attribute reduction and classifier fusion

作　　者：蔺国梁[1] 李恒杰[1] 高翔[1] 

机构地区：[1]甘肃联合大学电子信息工程学院,甘肃兰州730000

出　　处：《自动化与仪器仪表》2011年第6期19-21,24,共4页Automation & Instrumentation

基　　金：甘肃省教育厅重点科研资助项目(0013B-03)

摘　　要：针对入侵检测系统存在的对入侵事件高漏报率和误报率问题,提出利用粗糙集理论对数据集中的实值属性进行属性约简,然后把得到的特征向量送入分类器融合的Robust Online-SVM分类器,分类器对这些数字向量进行分类,处理结果送检测模块。检测模块按照报警关联分析策略,对报警序列进行基于规则关联分析。通过实验和比较发现,该融合算法可以实现在线训练,而且使用更少的支持向量,训练时间也大为缩短,在噪声数据存在的情况下检测正确率和虚警率比未改进前有一定程度的提升。To solving the problem of high rate of false negatives and false positives of IDS,an intrusion detection method was proposed in this paper which uses rough set theory on the data attributes of the real attribute reduction,and then to get the feature vector into Robust Online-SVM classifier,which classifies these vectors,then the results were send to detection modules,detection alert correlation analysis module in accordance with the strategy of rule-based alarm correlation analysis sequences.These experiments verify that the fusion algorithem can be trained online and the results outperform the original ones with fewer support vectors（SVs） and less training time without decreasing detection accuracy in the presence of noise.

关 键 词：入侵检测系统 粗糙集 属性约简 支持向量机 在线训练 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]