Abstract: In order to solve the problem that network intrusion detection was weak in training speed, real-time process and high false positive rate when dealing with big data, a Dendritic Cell TWin Support Vector Machine (DCTWSVM) approach was proposed. The Dendritic Cell Algorithm (DCA) was firstly used for the basic intrusion detection, and then the TWin Support Vector Machine (TWSVM) was applied to optimize the first step detection outcome. The experiments were carried out for testing the performance of the approach. The experimental results show that DCTWSVM respectively improves the detection accuracy by 2.02%, 2.30%, and 5.44% compared with DCA, Support Vector Machine (SVM) and Back Propagation (BP) neural network, and reduces the false positive rate by 0.26%, 0.46%, and 0.90%. The training speed is approximately twice as the SVM, and the brief training time is another advantage. The results indicate that the DCTWSVM is suitable for the comprehensive intrusion detection environment and helpful to the real-time intrusion process.

Key words: Dendritic Cell Algorithm (DCA), TWin Support Vector Machine (TWSVM), intrusion detection, big data

摘要： 针对入侵检测技术在处理大规模数据时存在的高误报率、低训练速度和低实时性的问题,提出了一种基于树突细胞算法与对支持向量机的入侵检测策略(DCTWSVM).利用树突细胞算法(DCA)对威胁数据进行初始检测,在此基础上利用对支持向量机(TWSVM)进行检测结果的优化处理.为了验证策略的有效性,设计性能对比实验,实验结果表明,相较于DCA、支持向量机(SVM)、反向传播(BP)神经网络,DCTWSVM策略的检测精度提高了2.02%、2.30%、5.44%,误报率分别降低了0.26%、0.46%、0.90%,训练速度相较于SVM提高了两倍且只需耗费极少的训练时间,可以更好地适用于大规模数据下的实时入侵检测环境.

关键词: 树突细胞算法, 对支持向量机, 入侵检测, 大数据