基于改进的SVM方法的异常检测研究

张辉; 刘成

doi:10.11959/j.issn.2096-109x.2016.00092

您当前的位置：

首页 >

文章列表页 >

基于改进的SVM方法的异常检测研究

学术论文 | 更新时间：2024-06-03

- 基于改进的SVM方法的异常检测研究
- Anomaly intrusion detection based on modified SVM
- 网络与信息安全学报 2016年2卷第8期页码：68-73
- 作者机构：
  
  1. 新疆公安厅特别侦察队，新疆乌鲁木齐 830000
  2. 国家计算机网络应急技术处理协调中心，北京 100029
- 作者简介：
  
  [ "张辉（1979-），女，河南镇平人，硕士，新疆公安厅特别侦察队技术八级工程师，主要研究方向为网络与信息安全、网络侦察技术。" ]
  [ "刘成（1985-），男，湖南邵阳人，博士，国家计算机网络应急技术处理协调中心高级工程师，主要研究方向为网络与信息安全、网络攻防技术。" ]
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2016.00092
  中图分类号： TP309/TP274
- 网络首发：2016-08，
  
  纸质出版：2016-08-15
- 稿件说明：
移动端阅览
张辉, 刘成. 基于改进的SVM方法的异常检测研究[J]. 网络与信息安全学报, 2016,2(8):68-73.

Hui ZHANG, Cheng LIU. Anomaly intrusion detection based on modified SVM[J]. Journal of network and information security, 2016, 2(8): 68-73.
张辉, 刘成. 基于改进的SVM方法的异常检测研究[J]. 网络与信息安全学报, 2016,2(8):68-73. DOI： 10.11959/j.issn.2096-109x.2016.00092.

Hui ZHANG, Cheng LIU. Anomaly intrusion detection based on modified SVM[J]. Journal of network and information security, 2016, 2(8): 68-73. DOI： 10.11959/j.issn.2096-109x.2016.00092.

摘要

利用非参数检验的方法提取出对分类结果影响显著的特征变量，提出一种改进的 SVM多分类方法（D-SVM），其融合了判别分析，可以解决样本不均衡导致的分类不准确和误报率高的问题。将多分类问题处理成一个个二分类问题，D-SVM既可以保持SVM较好的分类准确性，同时又可以不受样本不均衡的影响，具有较低的误报率。将 D-SVM 应用到 KDD99数据集，结果表明，该方法具有较高的分类准确性和较低的误报率。

Abstract

A modified SVM multi-classification algorithm integrated with discriminant analysis (D-SVM) was pro-posed

which could solve the problem of low detection accuracy and high false alarm rate caused by unbalanced datasets.For a multi-classification problem could be divided into several binary classification problems

D-SVM could not only have the virtue of high detection accuracy

but also have a low false alarm rate even confronted with unbalanced datasets.Experiments based on KDD99 dataset verify the feasibility and validity of the integrated ap-proach.Results show that when confronted with multi-classification problems

D-SVM could achieve a high detec-tion accuracy and low false alarm rate even when SVM alone fails because of the unbalanced datasets.

关键词

Keywords

references

LEE W , STOLFO S J , MOK K W . A data mining framework for building intrusion detection models [C ] // The IEEE Symposium on Security and Privacy . c1999 : 120 - 132 .

VERWOERD T , HUNT R . Intrusion detection techniques and ap-proaches [J ] . Computer Communications , 2002 , 25 ( 15 ): 1356 - 1365 .

ENDORF C F , SCHULTZ E , MELLANDER J . Intrusion detection＆prevention [M ] . McGraw-Hill Osborne Media , 2004 .

LIAO H J , LIN C H R , LIN Y C , et al . Intrusion detection system:a comprehensive review [J ] . Journal of Network and Computer Ap-plications , 2013 , 36 ( 1 ): 16 - 24 .

SHYU M L , CHEN S C , SARINNAPAKORN K , et al . A novel anomaly detection scheme based on principal component classi-fier [R ] . Coral Gables Department of Electrical and Computer En-gineering of Miami University , 2003 .

JAMDAGNI A , TAN Z , HE X , et al . Repids:a multi tier real-time payload-based intrusion detection system [J ] . Computer Networks , 2013 , 57 ( 3 ): 811 - 824 .

胡志鹏，魏立线，申军伟，等 . 基于核 Fisher 判别分析的无线传感器网络入侵检测算法 [J ] . 传感技术学报， 2012 ( 2 ): 246 - 250 .

HU Z P , WEI L X , SHEN J W , et al . An intrusion detection algo-rithm for wsn based on kernel Fisher discriminant [J ] . Chinese Jour-nal of Sensors and Actuators , 2012 ( 2 ): 246 - 250 .

MOK M S , SOHN S Y , JU Y H . Random effects logistic regression model for anomaly detection [J ] . Expert Systems with Applications , 2010 , 37 ( 10 ): 7162 - 7166 .

郭春 . 基于数据挖掘的网络入侵检测关键技术研究 [D ] . 北京 : 北京邮电大学， 2014 .

GUO C . Research on key technologies of network intrusion detec-tion based on data mining [D ] . Beijing : Beijing University of Posts and Telecommunications , 2014 .

LEE W , STOLFO S J , MOK K W , et al . Adaptive intrusion detection:a data mining approach [J ] . Artificial Intelligence Review , 2000 , 14 ( 6 ): 533 - 567 .

HWANG T S , LEE T J , LEE Y J . A three-tier IDS via data mining approach [C ] // The 3rd Annual ACM Workshop on Mining Network Data . c2007 : 1 - 6 .

AN W , LIANG M . A new intrusion detection method based on SVM with minimum within class scatter [J ] . Security and Commu-nication Networks , 2013 , 6 ( 9 ): 1064 - 1074 .

MUKKAMALA S , JANOSKI G , SUNG A . Intrusion detection using neural networks and support vector machines [C ] // The 2002 International Joint Conference on Neural Networks(IJCNN'02) . c2002 : 1702 - 1707 .

GAN X S , DUANMU J S , WANG J F , et al . Anomaly intrusion detection based on PLS feature extraction and core vector ma-chine [J ] . Knowledge-Based Systems , 2013 ( 40 ): 1 - 6 .

叶钢，余丹，李重文，等 . 一种基于Kolmogorov-Smirnov检验的缺陷定位方法 [J ] . 计算机研究与发展， 2013 ( 4 ): 686 - 699 .

YE G , YU D , LI C W , et al . Fault localization based on Kolmo-gorov-Smirnov testing model [J ] . Journal of Computer Research and Development , 2013 ( 4 ): 686 - 699 .

从飞云，陈进，董广明 . 基于AR模型的Kolmogorov-Smirnov检验性能退化及预测研究 [J ] . 振动与冲击， 2012 ( 10 ): 79 - 82 .

CONG F Y , CHEN J , DONG G M . Performance degradation as-sessment by Kolmogorov-Smirnov test and prognosis based on AR model [J ] . Journal of Vibration and Shock , 2012 ( 10 ): 79 - 82 .

陈敏 . 门限自回归模型条件异方差的 Kolmogorov-Smirnov检验 [J ] . 应用数学学报， 2002 ( 4 ): 577 - 590 .

CHEN M . A Kolmogorov-Smirnov test of conditional heterosce-dasticity for threshold autoregressive models [J ] . Acta Mathematicae Applicatae Sinica , 2002 ( 4 ): 577 - 590 .

李蕊 . 基于PCA和LOGIT模型的网络入侵检测方法 [J ] . 成都信息工程学院学报， 2014 ( 3 ): 261 - 267 .

LI R . A network intrusion detection method based on PCA and LOGIT model [J ] . Journal of Chengdu University of Information Technology , 2014 ( 3 ): 261 - 267 .

LIN W C , KE S W , TSAI C F . CANN:an intrusion detection sys-tem based on combining cluster centers and nearest neighbors [J ] . Knowledge-based systems , 2015 , 7 ( 8 ): 13 - 21 .

浏览量

2524

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

DNS异常检测：大规模实验分析

ADS-B安全研究综述

面向工业传感网络的时间序列异常检测综述

ContractGuard：面向以太坊区块链智能合约的入侵检测系统