GATS-LSVM:新的网络入侵检测方法

摘要

针对现有网络入侵检测方法的不足,提出了一种新的网络入侵检测方法——GATS-LSVM算法.该方法采用遗传算法(GA)与禁忌搜索(TS)相混合的搜索策略对特征子集空间进行随机搜索,利用提供的数据在无约束优化线性支持向量机(LSVM)上的分类错误率作为特征子集的评估标准获取最优特征子集,从而有效地对入侵进行检测.大量基于著名的KDD Cup 1999数据集的实验表明,该新方法相对于其它一些传统的网络入侵检测方法,能在保证较高检测率的前提下,有效地降低误报率、入侵检测的计算复杂度和提高检测速度,能更适用于现实高速网络应用环境.%Aiming at the shortcomings of existing network intrusion detection approaches,a new network intrusion detection scheme,called the GATS-LSVM algorithm,was proposed.The scheme uses the hybrid genetic algorithm (GA) and tabu search (TS) as the search strategy to specify a candidate subset for evaluation,and then uses the linear support vector machine (LSVM) as the evaluation function to obtain the optimum feature subset by the data classification error rate,so as to boost the detection performance.A series results of the experiment conducted based on the KDD cup 1999 dataset demonstrate that the proposed method has the higher detection rate and lower false alarm rate.Furthermore,the proposed method can reduce computational resources of intrusion detection,improve the detection speed and is more suitable for the real network applications than the traditional ones.