计算机应用 ›› 2013, Vol. 33 ›› Issue (02): 426-429.DOI: 10.3724/SP.J.1087.2013.00426

• 信息安全 • 上一篇    下一篇

基于对支持向量机的多类分类算法在入侵检测中的应用

聂盼盼,臧洌,刘雷雷   

  1. 南京航空航天大学 计算机科学与技术学院,南京 210016
  • 收稿日期:2012-07-11 修回日期:2012-08-29 出版日期:2013-02-01 发布日期:2013-02-25
  • 通讯作者: 聂盼盼
  • 作者简介:聂盼盼(1986-),女,河北保定人,硕士研究生,主要研究方向:网络安全;
    臧洌(1964-),女,江苏南京人,副教授,主要研究方向:网络安全、数据库;
    刘雷雷(1988-),女,安徽亳州人,硕士研究生,主要研究方向:网络安全。

Application of multi-class classification algorithm based on twin support vector machine in intrusion detection

NIE Panpan,ZANG Li,LIU Leilei   

  1. College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing Jiangsu 210016, China
  • Received:2012-07-11 Revised:2012-08-29 Online:2013-02-01 Published:2013-02-25
  • Contact: NIE Panpan

摘要: 针对基于传统支持向量机(SVM)的多类分类算法在处理大规模数据时训练速度上存在的弱势,提出了一种基于对支持向量机(TWSVM)的多类分类算法。该算法结合二叉树SVM多类分类思想,通过在二叉树节点处构造基于TWSVM的分类器来达到分类目的。为减少二叉树SVM的误差累积,算法分类前首先通过聚类算法得到各类的聚类中心,通过比较各聚类中心之间的距离来衡量样本的差异以决定二叉树节点处类别的分离顺序,最后将算法用于网络入侵检测。实验结果表明,该算法不仅保持了较高的检测精度,在训练速度上还表现了一定优势,尤其在处理稍大规模数据时,这种优势更为明显,是传统二叉树SVM多类分类算法训练速度的近两倍,为入侵检测领域大规模数据处理提供了有效参考价值。

关键词: 对支持向量机, 多类分类, 二叉树支持向量机, 入侵检测

Abstract: The multi-class classification algorithms based on traditional Support Vector Machine (SVM) are weak on training speed when dealing with large-scale data. To solve the problem, this paper proposed a multi-class classification algorithm based on Twin Support Vector Machine (TWSVM). It combined binary tree multi-class classification and constructed classifiers based on TWSVM on the nodes of binary tree. To reduce the error accumulation of Binary Tree SVM (BT-SVM), it firstly got clustering centers through the clustering algorithm, and then compared the distances between them to determine the separation sequence of classes. Finally, it was applied to network intrusion detection. The experimental results show that the proposed algorithm has higher detection accuracy and certain advantages on training speed especially for large-scale data. The training speed is approximately two times faster than that of the traditional BT-SVM algorithm. It is valuable for large-scale data processing in the field of network intrusion detection.

Key words: Twin Support Vector Machine (TWSVM), multi-class classification, Binary Tree Support Vector Machine (BT-SVM), intrusion detection

中图分类号: