In network intrusion detection, aiming to the problem that high dimensional and large network data results in long training time and low detecting speed of Support Vector Machine(SVM), this paper proposes an approach for SVM intrusion detection based on middle classification hyperplane: Based on clustering normal and attack training samples, by defining approaching degree of boundary surface of every clustering center, quadratic expression of standard SVM is improved; improved SVM is trained with clustering centers to obtain a middle classification hyperplane; then training samples are reduced by defining distance threshold to obtaining Possible Support Vectors(PSV). Experimental results on KDDCUP1999 data-set show that the method is more effective than cluster SVM in reducing training samples and improving the training and detecting speed of SVM.%在网络入侵检测中,大规模数据集会导致支持向量机(SVM)方法训练时间长、检测速度慢.针对该问题,提出一种基于中间分类超平面的SVM入侵检测方法.通过对正常和攻击样本的聚类分析,定义聚类簇中心的边界面接近度因子,实现对标准SVM二次式的改进;用簇中心对其训练,获取一个接近最优超平面的中间分类超平面;确定距离阈值,以选取潜在支持向量,实现训练样本的缩减.在KDDCUP1999数据集上进行实验,结果表明,与聚类支持向量机方法相比,该方法能简化训练样本,提高SVM的训练和检测速度.
展开▼
