IDS Method Based on Improved SVM Algorithm Under Unbalanced Data Sets

摘要

To solve the problems of difficultly obtaining abnormal samples in network intrusion detection application and overfitting of SVM due to the unbalanced abnormal data, a novel SVM detection model based on the combination of over-sample and KNN is presented in this paper. As the decision boundary of SVM is determined only by a small quantity of support vectors, consequently, based on SMOTE, a new minority over-sample method (BSMOTE) in which only the minority samples near the borderline are over-sampled is presented. The K-Nearest Neighbours (KNN) is adopted to remedy the problem of noise positive instances. The method achieves better detection performance than other methods under unbalanced data sets.