基于SVM和序列联配的攻击特征提取方法

摘要

Aiming at the fact that sequence alignment faces fragments and noise problems when it is used for attack signatures generation, support vector machine(SVM) classifier was used to convert a multi-attack sample into a single-attack sample in order to reduce the noise sequence in the sequence alignment, and based on the Smith-Waterman algorithm, an improved Smith-Waterman algorithm (ISW) was presented by changing the way of space penalty and introducing of continuous matching characters awards. A new attack signatures generator model was built by combining SVM classifier and ISW algorithm. The results show that the alignment results of this model can express attack signatures accurately and reduce the system false alarm rate.%针对序列联配应用于攻击特征提取时的碎片和噪声干扰问题,采用SVM分类器将多攻击样本转换成单一攻击样本,以减少联配过程中的噪声序列;在两序列联配Smith-Waterman算法的基础上,改变空位罚分方式,引入连续匹配字符奖励,提出一种改进的Smith-Waterman(ISW)算法.结合SVM分类器与ISW算法构建攻击特征提取模型.研究结果表明:该模型的联配结果能准确地表达攻击特征,降低检测系统的误报率.