Research Of An Approach To Intrusion Detection Based On Attribute Reduction Of Rough Set And Weighted SVM

As an active network security technology, intrusion detection can not only find outer intruders'attack, but also detect inner legal users'unauthorized operation. Hence, it is regarded as the second network security gate behind firewall. At present, many researchers have applied support vector machine(SVM) as a machine learning method to intrusion detection and obtained certain studying achievements. However, in the face of intrusion detection data possessing such properties as high dimension, large scale and imbalance, the following deficiencies exist in SVM intrusion detection method: long training time, slow detection speed and low detection rate in detecting the attack types including fewer samples.Aiming at the above deficiencies, an approach to intrusion detection based on attribute reduction of rough set and weighted SVM is presented and researched in the thesis. Meanwhile, simulation experiment is done in KDDCUP1999 data set. Based on it, experimental prototype for intrusion detection based on the proposed method is developed. Major research content is as following:Aiming at the problem that independent and redundant attributes in high dimensional intrusion detection data result in slow detection speed and low detection rate of classification algorithms in intrusion detection, according to rough set theory, a fast attribute reduction algorithm based on positive region(PRFAR) is proposed and an approach to feature selection of intrusion detection based on PRFAR is presented. Experimental result shows that compared with attribute reduction algorithms based on conditional information entropy, discernable matrixes and improved positive region, PRFAR attribute reduction algorithm can not only more effectively remove independent and redundant attributes of intrusion detection data to obtain optimal feature subset, but it can also more efficiently select optimal feature subset, which obviously heightens detection speed and detection rate of classification algorithms.Aiming at the problem that large scale and imbalance data in intrusion detection causes SVM intrusion detection method long training time, slow detection speed and low detection rate in detecting the attack types including fewer samples, a WSVM intrusion detection method based on middle classification hyperplane sample reduction(MCHSR-WSVM) is presented. Experimental result indicates that compared with Clustering-SVM and Reduction-SVM methods for intrusion detection, MCHSR-WSVM approach more effectively reduces training sample set. As a result, its training time is shorter, detection speed is faster and its detection rate of the attack types including fewer samples is higher.On the basis of above research results, an approach to intrusion detection based on attribute reduction of rough set and WSVM (RS-AR-WSVM)is proposed. In the method, PRFAR attribute reduction algorithm is first applied to select optimal feature subset of intrusion detection data , then MCHSR-WSVM method for intrusion detection is adopted to realize intrusion detection. Experimental result shows that compared with SVM, PRFAR-WSVM and MCHSR-WSVM methods for intrusion detection, training and detecting time of RS-AR-WSVM approach is less. Moreover, its detection rate of the attack types including fewer samples is high. Hence, proposed approach can overcome the deficiencies of SVM intrusion detection method in high dimension, large scale and imbalance intrusion detection data.An experimental prototype for intrusion detection based on RS-AR-WSVM intrusion detection method is designed and realized. Testing result indicates that the experimental prototype operates accurately.