Collaborative Intrusion Detection Based On Multi-class Support Vector Machine

With the rise of the Internet and the massive number of users increase,the new network threats and attacks continue to emerge. This is a new challenge to network security, especially, the problem of huge amounts of data, noise processing, as well as online learning, and network security is becoming the most important issues to be solved.Intrusion detection technology is another active network of differentiated firewall security technology. This system is based on monitoring the status of the host and analyze the network packets. The network behavior is divided into normal and abnormal behavior of two types. To detect all kinds of intrusion attempts and attacks, and to take further measures to effectively prevent.The support vector machine is a new machine learning methods based on statistical learning. It is based on support vector machine has the advantage of the global optimum, a small sample, nonlinear, and can be applied to network intrusion detection support vector machines, It can effectively overcome the curse of dimensionality, local minimum, etc. especially, in high-dimensional data space, to ensure the accuracy of intrusion detectionThis paper studies the issues related to multi-class support vector machine algorithm and collaboration mechanisms used in network intrusion detection. On the Home and abroad, the training algorithm of support vector machines and classification mechanism in-depth research, design intrusion detection model based on the synergy of multi-class support vector machine. The main work of this paper include:1. This paper take into account the network of massive data streams, Single detection agents is difficult to deal with today’s high-speed data stream, resulting in packet loss and can not be fully collected data, to analyze the network characteristics, eventually leading to the low detection rate.2. In this paper, realistic sample data are often not balanced status, the paper gives an improved weighted multi-class support vector machine classification, first of all the training samples according to protocol type attribute simple set of samples of the initial weight, based on the number of samples and sample properties,1-r class is constructed based on the weighted multi-class support vector machine model. Sample coincidence point as well as sample outliers, the decision function value normalized portfolio strategy preferred strategy to determine their respective categories.3. Collaborative model split from the data acquisition and task analysis, algorithm selection and integration of the results of coordination, and response in collaboration with three-level-depth study of a collaborative mechanism in this paper.Finally, the article uses the LIBSVM platform KDD99data set the training and testing to verify the detection of multi-agent collaborative intrusion detection performance.