基于序列互相关特性和SVM的入侵检测研究

通过刻画特权进程的系统调用来进行入侵检测已被广泛研究，采用的大多是人工智能方法，如支持向量机、隐马尔可夫模型和神经网络等。针对这种基于人工智能的入侵检测系统，本文提出应用序列互相关特性选择训练数据的方法。序列的互相关特性是刻画序列之间的相互关系的重要手段，使用具有一定特性的序列来训练人工智能模型，可以提高入侵检测的效率。在本文中，使用了支持向量机（SVM）来评价序列的互相关特性在模型训练中的作用。实验仿真说明，这种方法可以有效的提高入侵检测率。

Intrusion Detection Based on SVM and Cross-correlation of Sample Sequences

The intrusion detection using system call sequences has been widely studied.This kind of intrusion detection is usually based on the artificial intelligence,such as SVM(the support vector machine),HMM(the hidden markov model) and NN(the neural network).For this kind of intelligent intrusion detection system,the training dataset is important to the performance of the IDS.Applying cross-correlation to select the training data set can greatly improve the performance of the intrusion detection system.Cross-correlation is defined as a kind of important properties among system call sequences.In this paper,a new method based on the cross-correlation sample and SVM is proposed.This method is evaluated by the system call data set from Prof.Forrest.The simulation results show that this method has better intrusion detection rates.