一种基于SVDD的WLAN室内被动入侵检测方法  

A SVDD-based method for WLAN indoor passive intrusion detection

作　　者：高罗莹 田增山[1] 李玲霞[1] 张小娅 GAO Luoying;TIAN Zengshan;LI Lingxia;ZHANG Xiaoya(School of Communication and Information Engineering,Chongqing University of Posts and Telecommunications,Chongqing 400065,P.R.China)

机构地区：[1]重庆邮电大学通信与信息工程学院,重庆400065

出　　处：《重庆邮电大学学报（自然科学版）》2020年第2期200-209,共10页Journal of Chongqing University of Posts and Telecommunications(Natural Science Edition)

基　　金：国家自然科学基金(61771083,61704015);长江学者和创新团队发展计划(IRT1299);重庆市研究生科研创新项目(CYS17221)。

摘　　要：针对现有的被动入侵检测技术在不同监测环境下适应性较差,检测性能较低的问题,提出一种基于支持向量域描述(support vector domain description,SVDD)的无线局域网(wireless local area network,WLAN)室内被动入侵检测方法。该方法利用A-distance值评估多种特征正确区分静默和入侵2种状态的平均贡献度,根据平均贡献度挑选出最优特征组合来刻画监测环境中的不同状态,显著增强了系统的适应性。同时,引入单分类方法SVDD,只需采集静默数据训练被动入侵检测模型,有效地减少训练阶段的时间成本开销。此外,SVDD能在高维特征空间中训练出超球体异常检测边界,通过判断当前样本点是否在超球体之内,可实现准确的异常检测。实验结果表明,基于SVDD的WLAN室内被动入侵检测方法在降低训练开销的同时,能有效地提升系统的检测性能。Aiming at the problem that the existing passive intrusion detection methods have poor adaptability to different monitoring environments and low detection performance,this paper proposes an indoor passive intrusion detection method in wireless local area network(WLAN)based on support vector domain description(SVDD).The method utilizes A-distance to evaluate the average contribution of each feature to correctly distinguish the silent state and the intrusive state,which is used to select the optimal feature combination.Then,the method utilizes the selected optimal feature combination to characterize different states in the monitoring environment to significantly enhance the adaptability of the detection system.At the same time,the one-class classification SVDD is introduced,which only needs to collect the silent data to train the passive intrusion detection model.The experiment proves that the method can effectively reduce the time cost of the training phase.Besides,in the high-dimensional feature space,the hypersphere anomaly detection boundary can be trained by SVDD,which can be utilized to realize accurate anomaly detection by determining if the current sample point is within the boundary.The Experimental results show that the WLAN indoor passive intrusion detection method based on SVDD can effectively improve the detection performance of the system while reducing the training overhead.

关 键 词：WLAN 被动入侵检测 特征分析 SVDD 

分 类 号：TP[自动化与计算机技术]