论文部分内容阅读
为提高网络入侵检测的检测效果,提出了一种基于改进D-S证据理论的信息融合网络入侵检测方法。该方法首先采用支持向量机(S upport Vector Machine,SVM)统计机器学习方法分别对基于主机和基于网络的数据进行训练;然后针对D-S证据理论无法解决证据之间冲突问题,从合成规则着手,提出一种改进的D-S证据理论;最后采用改进的D-S证据理论对SVM的训练结果进行融合,兼顾了两类检测结果的优势,提高了网络入侵检测的性能。仿真结果表明,与单一的入侵检测策略相比,该方法能有效提高网络入侵检测的准确率,降低漏报率,提高了网络入侵检测的整体性能。
In order to improve the detection effect of network intrusion detection, an information fusion network intrusion detection method based on improved D-S evidence theory is proposed. This method firstly uses SVM (statistical machine learning) method to train host-based and network-based data respectively. Then, the DS evidence theory can not solve the conflict between evidences. Based on the synthetic rules, this paper proposes An improved DS evidence theory; Finally, the improved DS evidence theory is used to fuse the training results of SVM, taking into account the advantages of the two types of test results and improving the performance of network intrusion detection. Simulation results show that compared with a single intrusion detection strategy, this method can effectively improve the accuracy of network intrusion detection, reduce the false negative rate and improve the overall performance of network intrusion detection.