信息网络安全

信息网络安全 ›› 2015, Vol. 15 ›› Issue (2): 15-18.doi: 10.3969/j.issn.1671-1122.2015.02.003

• • 上一篇    下一篇

基于PCA的SVM网络入侵检测研究

戚名钰1, 刘铭2(), 傅彦铭2   

  1. 1.中国科学技术大学软件学院,安徽合肥 230000
    2.广西大学计算机与电子信息学院,广西南宁530004
  • 收稿日期:2014-05-21 出版日期:2015-02-10 发布日期:2015-07-05
  • 作者简介:

    作者简介： 戚名钰（1991-）,男,湖北,硕士研究生,主要研究方向：信息安全;刘铭（1990-）,女,河南,硕士研究生,主要研究方向：入侵检测;傅彦铭（1976-）,男,广西,副教授,博士,主要研究方向：信息安全。

  • 基金资助:
    国家自然科学基金[61262072];广西大学大学生实验技能和科技创新能力训练基金[SYJN20120735]

Research on Network Intrusion Detection Using Support Vector Machines Based on Principal Component Analysis

Ming-yu QI1, Ming LIU2(), Yan-ming FU2   

  1. 1. Software College, University of Science and Technology of China, Hefei Anhui 230000, China
    2. School of Computer, Electronics and Information, Guangxi University, Nanning Guangxi 530004, China
  • Received:2014-05-21 Online:2015-02-10 Published:2015-07-05

RichHTML

16

摘要：

文章针对传统入侵检测方法无法很好地对大样本数据降维、检测效率低、时间长、误报漏报率高等缺点,提出一种基于主成分分析（principal component analysis,PCA）的支持向量机（support vector machine,SVM）网络入侵检测方法（PCA—SVM）。该方法在对数据进行预处理之后,通过PCA对原始数据集的41个属性进行数据降维并消除冗余数据,找到具有最优分类效果的主成分属性集,然后再以此数据集训练支持向量机分类器,得到检测器。实验选择KDD99数据集在Matlab平台上对PCA-SVM算法进行仿真。相比于由传统41个属性训练得到的入侵检测器,文中方法大大缩短了检测时间,提高了检测效率,为网络入侵检测技术提供了一种新的可行方案。

关键词: 入侵检测, 主成分分析, 支持向量机, KDD99数据集, 属性约简

Abstract: Aim

ing at the shortcomings of the traditional intrusion detection system, such as low rate of detection, time wasting, high rate of false positives and so on, this paper proposed a method of network intrusion detection (PCA-SVM) using support vector Machines (SVM) based on principal component analysis (PCA). This method begins with data preprocessing, then find the optimal set of attributes by traversing the 41 principal component attribute values, finally training support vector machine classifier to obtain a detector based on this data set. This experiment has been simulated in the Matlab software with the KDD99 data. As a result compared with the traditional intrusion detector which training from 41 attributes, this method greatly reduces the detection time, improve the detection efficiency and reduce the rate of false positives. So it provides a new feasible solution for network intrusion detection technology.

Key words: intrusion detection, principal component analysis, support vector machine, KDD99 data set, attribution reduction

中图分类号: