【作者】 李佳；

【导师】 周铁军；

【作者基本信息】 中南林业科技大学 ， 计算机应用技术， 2009， 硕士

【摘要】 随着计算机网络技术的高速发展,利用广泛开放的网络环境进行全球通信已成为时代发展的趋势。网络在提供开放和共享资源的同时,也不可避免的存在着安全风险。曾经作为最主要的安全防范手段的防火墙,已经不能满足人们对网络安全的需求,网络用户面临着日益严重的安全问题,网络入侵已经成为计算机安全和网络安全的最大威胁。入侵检测作为一种主动防御技术,弥补了传统安全技术的不足。针对入侵检测在当今网络安全中发挥着越来越重要的角色,将粒子群优化算法和支持向量机引入到入侵检测系统中,提出了基于粒子群优化支持向量机的入侵检测设计方案。支持向量机是近两年研究较热的比较新颖的软测量技术之一,将支持向量机分类器应用到入侵检测中,可以保证在先验知识不足的情况下,支持向量机分类器仍有较好的分类正确率,从而使整个入侵检测系统具有较好的检测性能。支持向量机的参数选择决定了其学习性能和泛化能力,由于在参数的选择范围内可选择的数量是无穷的,在多个参数中盲目搜索最优参数是需要极大的时间代价,并且很难逼近最优。考虑到支持向量机模型性能的好坏很大程度上取决于其参数(C、σ)的取值情况,特别是参数之间的相互影响关系,本文研究采用粒子群算法实现对参数(C、σ)的同时寻优。粒子群优化算法来源于对鸟群觅食行为的研究,是一种生物进化算法,原理简单易于实现,对处理高维优化问题也有较强的优势。分析比对实验表明,采用粒子群算法可以同时寻到(C、σ)的最优值,以此最优参数建立的系统有效地减少报警数量,降低误报、漏报率,从而提高了报警的有效性。本文研究了粒子群优化算法、支持向量机理论和入侵检测理论,在此基础上作了如下工作：(1)阐述了粒子群优化算法的基本原理,并根据惯性权重的不同而做了一个粒子群优化算法的对比实验。(2)对支持向量机进行了分析和研究,发现支持向量机的推广能力的好坏,相当程度上取决于参数的选择及它们之间的相互关系。针对这个问题,提出了寻找最优的支持向量机参数对(C、σ)。(3)使用粒子群优化算法实现对支持向量机的参数对(C、σ)的同时寻优。通过仿真表明,粒子群优化算法对于选取支持向量机参数是一种的有效方法,可以取得令人满意的效果。更多还原

【Abstract】 With the fast development of computer network technology, the trend is to communicate globally using comprehensive open network environment. The network provides the open and shared resources, but there is always security risk. The firewall, once the most popular defensive method, can no longer meet people’s demand of network security, the users of network confront with the gradually grave safe problem and network’s invasion has become the most terrible threatens of computer and network’s safe. As an important and active security mechanism, Intrusion Detection(ID) will reinforce the traditional system security mechanism.Intrusion detection plays more important role in network security today. This paper introduces a method, particle swarm optimization and support vector machine, to intrusion detection system, and presents a new design of ID based on Particle Swarm Optimization(PSO) and Support Vector Machine(SVM). Support vector machine, as a new kind of soft sensor techniques, has been studied widely in the world recently. Support vector machine is based on Vapnik’s minimal of the structure risk, tries its best to increase the generalization. When using the method of support vector machine into intrusion detection system, better classification can be acquired at the condition that there is less known knowledge. So the method is applied in the intrusion detection system. The support vector machine parameter decides its study performance and exudes the ability. As the parameter choice is infinite, the parameter choice needs enormous time, and is very difficult to approach superiorly. Since the SVM model depend on a proper setting of its parameters(regulation parameter C and the radial basis function width parameterσ), especially on the interaction of the two parameters, this paper presents an optimal selection approach of the SVM parameters based on particle swarm optimization algorithm. PSO is a new biological evolutionary algorithm, origination from the behavior study of birds’seeking food. It can be implemented with easy principles and a few parameters need to be tuned, as well as it has maximum strength in dealing with high-dimension optimization problems. The experiments show that the optimal parameter selection approach based on PSO is available and the research of intrusion detection based on particle swarm optimization and support vector machine is effective in reducing the number of alerts, false positive, false negative better.The followings are the main contents based on the PSO algorithm, SVM theory and intrusion detection theory.(1) The principle of particle swarm optimization has been presented. According to the different inertia weight has made a comparative experiment on particle swarm optimization.(2) On support vector machine analysis and research, found that Generalization ability of support vector machines depend on the choice of parameters and their mutual relations. To address this issue, the paper put forward to find the optimal parameters(C、σ) of support vector machine.(3) Particle swarm optimization presents an optimal selection approach of the SVM parameters(C、σ).The experimental result shows that the classifier has stronger ability to distinguish garbage messages.更多还原