基于信息熵的SVM入侵检测技术

发布时间：2018-12-13 07:44

【摘要】：在传统基于SVM的入侵检测中,核函数构造和特征选择采用先验知识,普遍存在准确度不高、效率低下的问题。通过信息熵理论与SVM算法相结合的方法改进为基于信息熵的SVM入侵检测算法,可以提高入侵检测的准确性,提升入侵检测的效率。基于信息熵的SVM入侵检测算法包括两个方面:一方面,根据样本包含的用户信息熵和方差,将样本特征统一,以特征是否属于置信区间来度量。将得到的样本特征置信向量作为SVM核函数的构造参数,既可保证训练样本集与最优分类面之间的对应关系,又可得到入侵检测需要的最大分类间隔;另一方面,将样本包含的用户信息量作为度量大幅度约简样本特征子集,不但降低了样本计算规模,而且提高了分类器的训练速度。实验表明,该算法在入侵检测系统中的应用优于传统的SVM算法。
[Abstract]:In the traditional intrusion detection based on SVM, prior knowledge is used in kernel function construction and feature selection, which has the problems of low accuracy and low efficiency. Through the combination of information entropy theory and SVM algorithm, the SVM intrusion detection algorithm based on information entropy can improve the accuracy of intrusion detection and improve the efficiency of intrusion detection. The SVM intrusion detection algorithm based on information entropy includes two aspects: on the one hand, according to the user information entropy and variance included in the sample, the sample features are unified and measured by whether the feature belongs to the confidence interval. The obtained confidence vector of the sample feature as the construction parameter of the SVM kernel function can not only guarantee the correspondence between the training sample set and the optimal classification surface, but also obtain the maximum classification interval required for intrusion detection. On the other hand, the amount of user information contained in the sample is used as a measure to reduce the sample feature subset by a large margin, which not only reduces the size of the sample calculation, but also improves the training speed of the classifier. Experiments show that the proposed algorithm is superior to the traditional SVM algorithm in intrusion detection system.
【作者单位】：中国科学技术大学自动化系;中国人民解放军保密委员会技术安全研究所;
【分类号】：TP393.08

【相似文献】