基于SVM和序列联配的攻击特征提取方法  

Approach for attack signatures generating based on SVM and sequence alignment

作　　者：刘卫国[1] 胡勇刚[1] 

机构地区：[1]中南大学信息科学与工程学院,湖南长沙410083

出　　处：《中南大学学报（自然科学版）》2012年第11期4328-4332,共5页Journal of Central South University:Science and Technology

基　　金：国家自然科学基金资助项目(61073187)

摘　　要：针对序列联配应用于攻击特征提取时的碎片和噪声干扰问题,采用SVM分类器将多攻击样本转换成单一攻击样本,以减少联配过程中的噪声序列;在两序列联配Smith-Waterman算法的基础上,改变空位罚分方式,引入连续匹配字符奖励,提出一种改进的Smith-Waterman(ISW)算法。结合SVM分类器与ISW算法构建攻击特征提取模型。研究结果表明:该模型的联配结果能准确地表达攻击特征,降低检测系统的误报率。Aiming at the fact that sequence alignment faces fragments and noise problems when it is used for attack signatures generation, support vector machine（SVM） classifier was used to convert a multi-attack sample into a single-attack sample in order to reduce the noise sequence in the sequence alignment, and based on the Smith-Waterman algorithm, an improved Smith-Waterman algorithm （ISW） was presented by changing the way of space penalty and introducing of continuous matching characters awards. A new attack signatures generator model was built by combining SVM classifier and ISW algorithm. The results show that the alignment results of this model can express attack signatures accurately and reduce the system false alarm rate.

关 键 词：入侵检测 攻击特征自动提取 支持向量机 序列联配 SMITH-WATERMAN算法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]