An Intrusion Detection Method Based on Multiple Kernel Support Vector Machine

Network intrusion data has the characters such as small sample, nonlinear and high dimension, so the detection performance of single kernel support vector machine (SK-SVM) is instability. The choice of kernel function and relative parameters plays an important role in SK-SVM. It greatly influences the generalization performance of SK-SVM. According to the limitation of SK-SVM, in this paper we present an intrusion detection method based on multiple kernel support vector machine (MK-SVM). MK-SVM can calculate the weights of kernel functions and Lagrange multipliers simultaneously through semi-infinite linear programming, and thus achieve the choice of kernel functions and the optimization of classifier. Furthermore, in order to reduce the time and space required of this method, we adopt feature selection and clustering method in the process of input data preprocessing. The experimental results using KDD CUP 1999 show that our method has better adaptability and higher detection accuracy than the method based on SK-SVM.

I. Introduction

With increasing of the importance of network security, intrusion detection technology is a security measures which is becoming highly valued. Intrusion detection can be considered a kind of classification problem, it is always the research focus in the field of machine learning [1]. According to the characteristics of network intrusion data such as small sample, nonlinear and high dimension, SVM shows superior performance. As a general machine learning method based on the statistical learning theory, it can be easily generalized from linear SVM to nonlinear SVM. SVM combined with kernel method has the characteristics such as high generalization capability, global optimal solution and insensitive to the dimension of data. It has still good classification accuracy in the circumstances of the insufficient priori knowledge and training sample, and therefore intrusion detection system based on SVM has good detection performance too [2].