改进的增量式SVM在网络入侵检测中的应用  

Improved incremental SVM and application in network intrusion detection

作　　者：廖建平[1] 余文利[1] 方建文[2,3] 

机构地区：[1]衢州职业技术学院信息工程学院,浙江衢州324000 [2]衢州学院电气与信息工程学院,浙江衢州324000 [3]浙江大学计算机科学与技术学院,浙江杭州310027

出　　处：《计算机工程与应用》2013年第10期100-104,169,共6页Computer Engineering and Applications

摘　　要：针对传统的增量式支持向量机（Incremental Support Vector Machine,ISVM）在处理数据集时易受数据噪声和学习过程中振荡问题影响的缺点,将改进的核函数U-RBF和构造备用集的同心圆方法相结合,提出了基于备用集的增量式支持向量机（Reserved Set-Incremental Support Vector Machine,RS-ISVM）方法。该方法首先将特征属性的均值和均方差值嵌入到核函数RBF中,并通过同心圆方法将后续学习过程中最有可能成为支持向量的样本划入备用集。入侵检测实验证明RS-ISVM能够降低学习过程的振荡现象,提高了学习的速度,有非常好的性能和可靠性。Due to the shortcomings of data noise and the learning process’s oscillation problem when traditional incremental support vector machine deals with data samples, an incremental SVM based on reserved set is proposed, which combines modified kernel function with concentric circle method to structure the reserved set. The proposed method embeds the mean and mean square difference values of feature attributes in kernel function RBF. In order to shorten the training time, a concentric circle method is suggested to be used in selecting samples to form the reserved set. The intrusion detection experiments show that RS-ISVM can ease the oscillation phenomenon in the learning process and achieve pretty good performance, meanwhile, its reliability is relative high.

关 键 词：网络入侵检测 增量式支持向量机 备用集 改进的核函数 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]