基于邻界区的快速增量 SVM 入侵检测算法的研究

摘要

为了解决SVM算法针对海量、非平衡样本的入侵检测存在训练速度慢等问题，提出基于邻界区的快速增量SVM入侵检测算法。在该算法中，首先利用均值和标准差的K均值聚类分析算法对训练样本集进行邻界区生成，然后对邻界区数据集进行样本筛选，剔除成为支持向量概率较小的点和噪声或过拟合点，最后通过增量学习模式构造最优超平面，生成最优SVM分类器。实验仿真证明，该算法具有较好的分类性能，能有效提高入侵检测的检测精度和检测率，降低误报率。%In order to solve the problem of slow training speed the SVM algorithm has when used for intrusion detection of mass and non-equilibriumsample, we propose the adjacent boundary area-based fast incremental SVM intrusion detection algorithm .In this algorithm, first, the mean and the k-mean clustering analysis algorithm for standard deviation are used on training sample set for the generation of adjacent boundary area;then, the sample screening is carried out on adjacent boundary area data sets , the points with smaller support vector probability and the noise or the over-fitting points are weeded out; finally, the optimal hyperplane is constructed with incremental learning mode to generate optimal SVM classifier .Experimental simulation proves that this algorithm has good classification performance and can effectivelyenhance the intrusion detection accuracy and detection rate , reduce false alarm rate.