Research On Intrusion Detection Based On Rough Sets And Svm

The objective of this thesis is an intrusion detection system based on the combination of rough set and SVM to improve the detection accuracy rate of the intrusion detection,reduce the false alarm rate and omission rate of the intrusion detection. And the following aspects are studied:First, it introduces the concept and significance of the intrusion detection system.Then it introduces several new methods of intrusion detection, analyse the existing problems of the intrusion detection system and make a prospect on the development direction of intrusion detection technology.Second, it makes use of the knowledge of the rough set theory on the characteristics attribute reduction , and then apply rough set theory on simplifying the training sample data set to analyse the change relationship between attribute reduction and the increasing of object set.Third,it applies SVM in intrusion detection,sampling the small sample data, reduces the size of training data,and applies incremental learning in SVM to reduce the occupation of storage space and reduces the time of follow-up training.Fourth, an algorithm of incremental absolute attribute reduction is recommended,it applies incremental learning in intrution detection, the self-learning and self-adaptability and robustness of the system is greatly improved, the experiments indicates that this reduction algorithm strikingly improves the efficiency.Fifth, a new method of intrusion detection based on the combination of rough set and online-SVM is brought forward. Records of the characteristics of the network connection for high-dimension, using the method of rough set attribute reduction to compress data space, it reduces the size of the data-processing under the promise of useful information is not lost.When it trains the data by online SVM ,it abandons the traditional method of needing high-quality samples on the assumption,it uses the method of updating real-time samples for real-time data classification training and testing. The experiment indicates that this method can reduce the cost of time and make the extraction rule with real-time, in line with the requirements of the reality of work.