基于核方法的网络入侵检测若干研究

发布时间：2019-05-12 10:08

【摘要】：随着网络的日益普及，网络安全问题日益突出，，如何保证网络系统的安全成为了一个亟待解决的问题。将核主成分分析（KPCA）、粒子群优化算法（PSO）和支持向量机（SVM）相结合并应用于入侵检测中，不但解决了数据信息的冗余性，而且避免了SVM参数选取的盲目性，更加提高入侵检测的性能。本文主要是对核方法在入侵检测中的应用进行研究。首先，对KPCA算法进行研究与分析，提出了一种混合核主成分分析算法。其次，针对SVM的参数选取进行研究，在PSO算法的基础上，提出了两种新的优化算法。本文的主要创新如下：（1）提出了基于混合核函数的MKPCA（Multiple Kernel Principal Component Analysis,MKPCA）算法。该算法对入侵检测数据进行特征提取，在保证数据信息量完整情况下，降低了数据的维数。本文提出的MKPCA算法的核函数不是单一核，而是结合全局核函数（多项式核函数）和局部核函数（高斯核函数）的双核核函数，提高了KPCA（Kernel PrincipalComponent Analysis, MKPCA）的非线性特征提取能力。通过MKPCA特征提取实验，可以看出原始数据通过特征提取后分类的正确性得到提高，同时加快了数据的训练与测试速度。（2）提出了基于动态粒子群优化的SVM（Dynamic Particle Swarm Optimization-SupportVector Machine, DPSO-SVM）入侵检测算法。该算法引入动态惯性权重函数和加速因子函数来加强PSO算法搜索能力，平衡PSO算法全局搜索能力和局部搜索能力，并将该算法应用于SVM的参数优化。本文利用DPSO-SVM算法对MKPCA处理后的入侵数据进行分类实验，结果表明该算法提高了分类的准确性，加快了算法趋于最优解的收敛速度。（3）提出了基于动态混沌粒子群优化的SVM（Dynamic Chaos Particle Swarm Optimization-Support Vector Machine, DCPSO-SVM）入侵检测算法。该方法将混沌搜索与本文提出的动态粒子群算法相结合。DCPSO不仅对PSO算法的主要参数进行动态选择而且提高种群的多样性和粒子搜索的遍历性，进一步的改善了PSO算法的精度、收敛速度。通过DCPSO-SVM在入侵检测中的实验，可以看出算法的分类正确率和收敛效率都得到了提高。
[Abstract]:With the increasing popularity of the network, the problem of network security is becoming more and more prominent. How to ensure the security of the network system has become an urgent problem to be solved. The combination of kernel principal component analysis (KPCA),) particle swarm optimization (PSO) and support vector machine (SVM) in intrusion detection not only solves the redundancy of data information, but also avoids the blindness of SVM parameter selection. Further improve the performance of intrusion detection. This paper mainly studies the application of kernel method in intrusion detection. Firstly, the KPCA algorithm is studied and analyzed, and a hybrid kernel principal component analysis algorithm is proposed. Secondly, the parameter selection of SVM is studied, and two new optimization algorithms are proposed on the basis of PSO algorithm. The main innovations of this paper are as follows: (1) A MKPCA (Multiple Kernel Principal Component Analysis,MKPCA algorithm based on hybrid kernel function is proposed. In this algorithm, the feature extraction of intrusion detection data is carried out, and the dimension of the data is reduced under the condition of ensuring the integrity of the data information. The kernel function of the MKPCA algorithm proposed in this paper is not a single kernel, but combines the binomial kernel function of the global kernel function (multinomial kernel function) and the local kernel function (Gao Si kernel function) to improve the nonlinear feature extraction ability of KPCA (Kernel PrincipalComponent Analysis, MKPCA). Through the experiment of MKPCA feature extraction, it can be seen that the correctness of classification of the original data after feature extraction is improved, and the training and testing speed of the data is accelerated at the same time. (2) an intrusion detection algorithm based on dynamic particle swarm optimization (SVM (Dynamic Particle Swarm Optimization-SupportVector Machine, DPSO-SVM) is proposed. The dynamic inertia weight function and acceleration factor function are introduced to enhance the search ability of PSO algorithm and balance the global search ability and local search ability of PSO algorithm. The algorithm is applied to the parameter optimization of SVM. In this paper, the DPSO-SVM algorithm is used to classify the intrusion data processed by MKPCA. The results show that the algorithm improves the accuracy of classification and accelerates the convergence speed of the algorithm to the optimal solution. (3) A SVM (Dynamic Chaos Particle Swarm Optimization-Support Vector Machine, DCPSO-SVM intrusion detection algorithm based on dynamic chaotic particle swarm optimization is proposed. This method combines chaotic search with the dynamic particle swarm optimization algorithm proposed in this paper. DCPSO not only dynamically selects the main parameters of PSO algorithm, but also improves the diversity of population and ergodicity of particle search, and further improves the accuracy of PSO algorithm. Convergence rate. Through the experiment of DCPSO-SVM in intrusion detection, it can be seen that the classification accuracy and convergence efficiency of the algorithm have been improved.
【学位授予单位】：南京邮电大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】