摘要
提出一种使用支持向量机 (SVM)进行计算机系统实时异常检测的方法 ,内容涉及到一种对支持向量机方法的改进算法、对数据预处理的方法及SVM核函数的选取 .试验结果表明采用这一算法进行入侵检测具有准确率高、计算简单、占用的存储空间小等优点 .
A key component of computer security techniques, intrusion detection has gotten more and more attention. An overview of our research on anomaly detection is presented, which uses system call traces as audit data. It is focused on issues related to constructing a support vector machine(SVM) for detecting intrusion or misuse of computers, and introduce an improved algorithm for SVM. A method for the pretreatment of audit data is given, and the choice of kernel function is discussed. To improve performance, the sequential minimal optimization(SMO) as the update algorithm for the SVM is used. This method is not only useful in theory, but also can be used in practice to monitor the computer system in real time.
