基于支持向量机与k近邻相结合的网络入侵检测分析-analysis of network intrusion detection based on support vector machine and k - nearest neighbor.docxVIP

AbstractIntrusion detection, as a proactive defense, has gradually become the hotspot of information security research field in recent years. According to the process of information security level protection assessment project, we have found the detect accuracy of current intrusion system still need to be improved when it detected the main four types attacks: Dos, probing, R2L and U2R.The classification model based on support vector machine algorithm can?t classify the samples which near the optimal classification surface; the classification model based on k nearest neighbor algorithm is susceptible to the unbalance distribution of samples, leading to the unstable evaluated result. In order to further improve the accuracy of intrusion detection system on the basis of the original classified accuracy, the paper put forward to a intrusion detection classified model which combine support vector machine algorithm and k nearest neighbor algorithm. In the classification phase, it calculates the distance between the samples of network connection records and the optimal classification hyper plane, if the distance is longer than the default threshold, using the support vector machine algorithm to classify the connection records; otherwise, using k nearest neighbor algorithm to classify the connection records. The main work and innovation can be summarized as follows:The paper proposed the classification method of combining support vector machine algorithm with k nearest neighbor algorithm in the field of intrusion detection for the first time, which according to the distribution of samples in the feature space, adopting the corresponding classification algorithm to classify the samples.In order to reduce the negative influence caused by the unbalance distribution of samples when used k nearest neighbor algorithm, it employs Euclidean Distance which carries weighted factor to measure the similarity among samples.In the data preprocessing stage, it normalized three types of da