基于参数优化 SVM 融合的网络异常检测

摘要

网络异常检测技术是入侵检测系统中不可或缺的部分。然而目前的入侵检测系统普遍存在检测率不高，误报率过高等问题，从而难以在实际的企业中大规模采用。针对之前的检测技术检测效果不佳的问题，提出基于SVM回归和改进D-S证据理论的入侵检测方法。该方法是将支持向量机回归的分类融合应用到网络异常行为分析中，在SVM参数选择时采用交叉验证和深度优先搜索算法进行优化选择，并通过融合证据理论，建立网络异常检测模型。通过仿真实验表明，该模型能够有效地提高入侵检测性能，缩短检测时间。%Network anomaly detection technology is an indispensable part in intrusion detection system .However, currently the poor detection rate and high false positive rate in intrusion detection systems are widely existed , so the large-scale use of it is difficult in practical enterprises .Aiming at the poor detection effect in previous detection technologies , we propose an intrusion detection method which is based on SVM recession and improved D-S evidence theory .This method applies the classifier fusion of support vector machine ’ s regression to network abnormal behaviour analysis , and uses cross-validation and depth-first search algorithm for optimised selection when choosing the SVM parameters;it builds a network abnormal detection model with D-S evidence theory .Through the experiment it is proved that this method can effectively improve the intrusion detection performance and shorten the detection time .