Abstract: Through the research for the type of network attack and the intrusion detection method,the fact that the normal intrusion detection method is not good enough for detecting U2R and R2L was found. To improve the detection rate of anomaly detection system for U2R and R2L, an anomaly detection model based on support vector machines and Bayesian classifying was suggested. In order to reduce the redundant records in the training data , the BIRCH clustering algorithm is used, besides, the detection model applys SVM for detecting DoS and Probe and uses Bayesian classifying to detect U2R and R2L. Experimental results show that the proposed model can improve obviously detection rate for U2R and R2L.

Key words: Anomaly Detection, BIRCH, SVM, Bayesian, KDD99

摘要： 通过对网络攻击类型和入侵检测方法的研究，发现常用的入侵检测方法不能很好地检测U2R和R2L两类攻击。为解决异常检测中对于U2R和R2L两类攻击检测率低的问题，提出了一种基于支持向量机和贝叶斯分类的异常检测模型，该模型利用BIRCH聚类算法减少训练数据集中重复记录，并利用支持向量机分类算法和贝叶斯分类算法分别检测DoS、Probe攻击和U2R、R2L攻击。实验结果表明，该模型对于U2R和R2L的检测率分别提高到了68.6%和45.7%。

关键词: 异常检测, BIRCH聚类, 支持向量机, 贝叶斯分类, KDD99