关键词: 异常检测, BIRCH聚类, 支持向量机, 贝叶斯分类, KDD99

Abstract: Through the research for the type of network attack and the intrusion detection method,the fact that the normal intrusion detection method is not good enough for detecting U2R and R2L was found. To improve the detection rate of anomaly detection system for U2R and R2L, an anomaly detection model based on support vector machines and Bayesian classifying was suggested. In order to reduce the redundant records in the training data , the BIRCH clustering algorithm is used, besides, the detection model applys SVM for detecting DoS and Probe and uses Bayesian classifying to detect U2R and R2L. Experimental results show that the proposed model can improve obviously detection rate for U2R and R2L.

Key words: Anomaly Detection, BIRCH, SVM, Bayesian, KDD99