Application Of Intelligence Technique For Intrusion Detection

With the rapid development of computer and network technologies, computer system has been developed to a complicated and interconnected opening system, which results in more serious problems of intrusion detection. Intrusion detection system (IDS) is a system that continuously monitors some dynamic behavioral characteristics of network or computer system to determine it if intrusion detection occurs. However, it is difficult to enhance the detection speed and improve the accuracy for detecting abnormal intrusion under some shortcoming of the intrusion detection. Therefore, it is urgent and necessary to formulate the algorithm into the intrusion detection system, so as to enhance the detection speed.A new type of intrusion detection system—abnormal intrusion detection is presented based on support vector machine, self-similarity and intelligence principles of computer.The innovations of this paper are shown as follows. (1) The general ability of current abnormal intrusion detection system (IDS) is limited with the consideration of less priori knowledge, more false alarms and no alarm. Interestingly, the general ability of IDS is still well when the sample size is small. This paper proposes a sort of abnormal IDS on the basis of a novel support vector machine (SVM). Furthermore, in order to enhance training speed and decrease detecting time, quantum-behaved particle swarm optimization (QPSO) is used to solve the problem of quadratic programming (QP). Subsequently, the model of parallel intrusion detection system is presented to realize on-line detection and to reduce delay detection time with a certain false alarm rate. (2)The traditional methods were not suitable for detecting abnormal attack, identifying busy traffic, avoiding false alarm and missing alarm. A probability density method was proposed to detect the abnormal attack resting on the influence of abnormal network on self-similarity. In addition, the novel method is carried out to analyze accurate detection, false alarm and missing alarm.