Research Of Optimization Method For Semi-supervised Learning In Intrusion Detection

Along with the rapid development of networks, the security problem of system or networkbecomes more and more important. As a positive technique of security prevention, Intrusion DetectionSystems are complementarities to security mechanism of computer networks and have an importantrole in protecting the security of computer and network. Semi-supervised Support Vector Machines isa hot theory in the fields of machine learning, and its application attracts more and more attention ofacademic researchers at home and abroad.This paper has analyzed the advantages and disadvantages of the present intrusion detectionmethod based on Semi-supervised Support Vector Machines combined with the characteristics ofIntrusion Detection System, and then proposes an optimization intrusion detection method based onSemi-supervised Support Vector Machines. At first, this paper detailed introduces the knowledge ofintrusion detection，summarize the problem and future research direction of Intrusion DetectionSystem. And then it introduces the technical background and theoretical basis of semi-supervised andSupport Vector Machines systematically. Intrusion detection training dataset usually contains a fewlabeled data and abundant unlabeled data. There usually exist more than one large-margin low-densityseparators in intrusion detection. It is hard to decide which one is the best one based on the limitedlabeled data. And it is well known that only support vectors determine the accuracy of model duringthe training procedure of support vector machines, but support vectors usually take up a smallproportion of all the training set. In order to solve above problem, this paper proposes an optimalsemi-supervised intrusion detection method (MLL_S3VM). This method search for diverselarge-margin separators by clustering method using pre-processing of training set, unlabeled examplesare estimated using distance vector method at last. In this experiment, we take the rate of detectionand false alarms as the standard to evaluate the algorithm performance. We make a contrast of thisimproved method with that former in experiments. Our experiments show the performance ofMLL_S3VM is competitive to traditional S3VM. So the research of this paper has sometheoretical significance and practical value.