Abstract: Support vector machine, as a new statistical learning model, possesses great advantages in small sample and machine generalization ability. This paper utilizes the classification feature of SVM to recognize intrusion, and gives SVM-based intrusion detection system. It focuses heavily on detection correctness and performance as to different SVM kernel functions and other parameters. Meanwhile, as to BP-based intrusion detection, SVM-based intrusion detection shows great advantages in detection correctness and performance, which is demonstrated. Moreover, the hybrid system framework using SVM to improve the detection correctness and performance is also proposed in the end of the paper, which aims at solving the main problem, high false positives of the current commercial IDS

Key words: Support vector machine(SVM); Statistical learning model; Intrusion detection

摘要： 支持向量机(SVM)作为一种新型的统计学习模型，在处理小样本和学习机的推广能力上具有很大的优势。该文应用SVM 的分类特性来识别网络攻击行为，提出了基于SVM 的入侵检测方法。重点考察了不同SVM 核函数和参数选择对检测准确率和实时性的影响。论证了基于SVM 的入侵检测在性能和识别率上都明显优于基于BP 网络的攻击识别，还就目前商用入侵检测系统存在较高误报率的问题，分析了用SVM 来提高其检测实时性和识别准确率的系统框架。

关键词: 支持向量机；统计学习模型；入侵检测