摘要： 将One-class支持向量机和Online训练算法应用于入侵检测研究中，把入侵检测看作是一种单值分类问题，能够在有噪声的数据集中进行训练，降低了对训练集的要求，提高了检测准确性。同时解决了基于SVM的入侵检测系统实时训练的问题，在实际运用中可以实时地添加新的训练样本对新出现的攻击手段进行分类。在KDD CUP’99标准入侵检测数据集上进行实验，系统缩短了训练时间并且获得了较高的检测准确率。

关键词: 信息安全, 入侵检测, 支持向量机

Abstract: This paper presents an algorithm for intrusion detection, based on one-class support vector machine (SVM) and online training of SVM. The algorithm formulates intrusion detection as a one-class classification problem. The model-building part of the algorithm works even when the training data is noisy, and therefore compared with regular SVM algorithms, it imposes fewer requirements on the training set and has a higher detection rate. For the testing data containing new types of attack, the algorithm can add such data to the training set and update the training result real-time. It tests the algorithm on KDD CUP’ 99 benchmark data set for intrusion detection and the result shows that the algorithm is able to shorten the training time, and in the same time, obtain a high detection rate.

Key words: Information security, Intrusion detection, Support vector machines (SVM)