论文部分内容阅读
入侵检测作为一种积极主动的防御技术,已成为信息安全领域的重要研究内容。将统计机器学习方法引入到入侵检测技术中,具有重要的现实意义。但单纯使用支持向量机的机器学习方法对网络连接记录进行分类,对于远离分类超平面的正负实例点能以充分大的确信度将它们区分开来,但对于离分类面比较近的实例点,被正确分类的可信度较低,还有可能因为各种主客观的因素造成误分类。为此,引入K近邻法,对分类面附近的实例点进行二次分类,并借鉴KDDCUP99公共数据集描述网络连接的41个特征进行了仿真实验,实验结果表明,相比单独使用支持向量机的方法,分类的准确率有了进一步的提高。
As a proactive defense technology, intrusion detection has become an important research field in the field of information security. The introduction of statistical machine learning methods into intrusion detection technology has important practical significance. However, machine learning methods based on SVM only classify network connection records, and distinguish positive and negative instances of points away from the classification hyperplane with sufficient confidence, but for instance points that are relatively close to the classification plane , The credibility of the correct classification is low, there may be because of various subjective and objective factors causing misclassification. Therefore, the K nearest neighbor method is introduced to classify the instance points near the classification surface. The author also uses the KDDCUP99 public dataset to describe the 41 characteristics of the network connection. The experimental results show that, compared with the SVM alone Methods, classification accuracy has been further improved.