基于KKT和超球结构增量SVM算法云架构入侵检测系统.docVIP

基于KKT和超球结构增量SVM算法云架构入侵检测系统 　　摘要：针对传统入侵检测系统（IDS）处理数据负载过重，不支持多主机数据联合分析，以及大规则库维护的问题，提出一种云架构的基于卡罗需库恩塔克（KKT）条件和超球结构的增量支持向量机（KSISVM）入侵检测系统。将客户端抓取的数据包经过预处理生成样本空间，然后发送至云端使用KSISVM进行建模分析，利用KKT条件对增量样本进行筛选，选取违反KKT条件的样本作为有用样本，剔除KKT范围内的所有样本；此外，为了保证剔除的样本为冗余样本，进一步采用超球结构的方法对样本进行第二次筛选，将超球范围内的样本作为有用样本，剔除其余样本；最后将选取的样本进行合并，对SVM进行更新训练。利用KDDCUP99数据进行实验验证，并与SVM、批量支持向量机（BatchSVM）、互检KKT条件的增量学习（KISVM）算法进行对比，结果表明，KSISVM具有良好的预测能力和样本淘汰能力，准确率达到90.3%，而SVM、BatchSVM和KISVM三种方法准确率均在89%以下；同时还对并行KSISVM进程联合分析，发现单进程的分析时间由6351s降低到16进程的146s，分析时间大大降低，说明了多进程的有效性，满足云计算环境中的入侵检测系统对效率和精度的要求。 　　关键词：入侵检测系统；云架构；增量支持向量机；卡罗需库恩塔克条件； 超球结构 　　中图分类号： TP393.0 　　文献标志码：A 　　Abstract： In view of overload， nonsupport of multicomputer conjunction analysis and maintenance of huge rule database in traditional Intrusion Detection System （IDS）， a new kind of cloud architecture IDS with Incremental Support Vector Machine （ISVM） algorithm based on KKT condition and hypersphere， namely KSISVM was proposed. The network data captured by client were preprocessed and sent to the cloud as samples. The KSISVM was used to analyze these samples in cloud. According to the KKT condition， the samples that violated the KKT condition were selected as useful samples， and the others that met the KKT condition were removed. In addition， in order to ensure that the removed samples were redundant， they were screened again by hypersphere， after that， the samples which met the hypersphere rule were regarded as useful samples， while the others were deleted. Finally， the SVM was trained and updated by merging those selected useful samples. Contrast experiments with SVM， BatchSVM and Incremental SVM based on KKT （KISVM） were carried out on KDDCUP 99. The results show that KSISVM has good performance in prediction and selection of samples， its accuracy can reach 90.3%， but the accuracy of SVM， BatchSVM and KISVM are all below 89%. Through analyzing the parallel KSISVM processes， the analyzing time of the single process is 6351s， while that of 16 processe