基于超球支持向量机的键盘异常检测  

Keyboard Abnormal Detection Based on Hyper-Sphere Support Vector Machine

作　　者：赵峰 铁治欣[1] 谢磊 ZHAO Feng1, TIE Zhi-Xin1, XIE Lei1(School of Informatics and Electronics, Zhejiang Sci-Tech University, Hangzhou 310018, Chin)

机构地区：[1]浙江理工大学信息学院,杭州310018

出　　处：《计算机系统应用》2018年第4期231-236,共6页Computer Systems & Applications

基　　金：浙江省公益技术应用研究项目(2014C31G2060072)

摘　　要：将改进粒子群算法(IPSO)优化超球支持向量机(HSSVM)应用于键盘的异常检测.首先,在Windows操作系统中,利用开发的钩子(hook)程序,通过系统消息WM_KEYDOWN和WM_KEYUP捕获键盘的击键消息,收集整理需要的按键时间序列作为训练集和测试集;然后,采用HSSVM模型进行样本训练,最终转化为一个二次规划问题,其中利用IPSO对HSSVM模型的惩罚因子和核参数进行寻优;最后,采用测试集对模型检测准确率进行验证,并和优化前结果对比.测试结果表明:IPSO-HSSVM模型应用于键盘的异常检测有效可行,准确率达到90%以上,且比优化前的HSSVM检测效果要好,但要获得更高的检测准确率,还需要进一步提高训练样本的质量和数量.The improved particle swarm optimization （IPSO） optimized hyper-sphere support vector machine （HSSVM） can be used for abnormal detection of keyboard in this paper. Firstly, the development of the hook （hook） procedure in the Windows operating system is used to collect the required key time series as a training set and test set through the system messages WM_KEYDOWN and WM_KEYUP capture keyboard keystroke messages. Then, the HSSVM model is used to carry out sample training and finally transformed into a quadratic programming problem. The IPSO is used to optimize the penalty factor and kernel parameters of HSSVM model. Finally, the test set is used to verify the accuracy of the model detection and is compared with the results before optimization. The test results show that the IPSO-HSSVM model is effective for the detection of the keyboard and the accuracy rate is over 90%, which is better than that of the HSSVM before optimization. However, it is necessary to further improve the quality and quantity of the training samples in order to obtain higher detection accuracy.

关 键 词：超球支持向量机 钩子程序 异常检测 击键消息 粒子群算法 

分 类 号：TP18[自动化与计算机技术—控制理论与控制工程] TP334.23[自动化与计算机技术—控制科学与工程]