基于混沌同步与相关向量机的入侵检测算法研究-通信与信息系统专业论文.docxVIP

第 第 II 页 只选择重要特征进行 RVM 分类器的训练和测试，可以有效地提高分类 器的检测率，并降低其误警率和减少检测时间。经过使用 DARPA 数据 仿真，使用 RVM 可以获得与 SVM 相近的检测效果，但是检测速度相 比于 SVM 大为提高，因此可以获得更高的检测效率。 通过分析比较，本文引入的两种方法应用于入侵检测系统以后，均 能使检测性能在原有方法的基础上获得一定的提升，并且可以达到实际 使用的标准。 关键词：入侵检测，ARMA 模型，GMM 模型，EM 算法，混沌同步， DARPA，SVM，RVM 第 第 III 页 RESEARCH OF INTRUSION DETECTION BASED ON CHAOS SYNCHRONIZATION AND RELEVANCE VECTOR MACHINE (RVM) Abstract Intrusion detection technology is an important research branch in the field of network information security. With the widespread use of Internet, network hackers increase frequently which lead to the increasing of attack methods. Network intrusion detection technology has become a hot point of computer network security research. The research staff has to do deepened research work. Intrusion Detection System is an active defense system, and it can make real-time reaction to new intruding events, based on the behavior and feature of former intruding signals. Intrusion Detection System is an important complement to firewalls. This paper presents two new intrusion detection algorithms, which make greatly improved in detection efficiency and detection accuracy. Current intrusion detection systems based on linear ARMA model have been used in many fields. A new detection method based on chaos synchronization has been introduced in this paper. The network flow can be modeled by using GMM combined with EM algorithm, and then the three parameter vectors can be estimated. Take the difference between normal flow data and data for detection as Liu chaos synchronization’s control measure, when it has intrusion signals, the wave plot would be oscillating, which is the feature of intrusion. When selecting the suitable threshold, the intrusion signals can be detected accurately. According to the simulations based on the DARPA datasets of MIT Lincoln Lab and the comparisons with the Intrusion Detection System (IDS) based on autoregressive moving 第 第 PAGE VIII 页 average (ARMA) model, the results show that