Application Research Of Network Intrusion Detection Based On Decision Rough Set And SVM Algorithm

In recent years,with the progress of society and the rapid development of digital informatization,the "Internet +" development model has integrated the Internet with all walks of life,making people's life become more efficient.At the same time,the rapid spread of the Internet will bring about a series of security problemes.Intrusion Detection System?IDS?can monitor the system or network resources in real time,detect network intrudes in a timely manner.It can also prevent legitimate users from misusing resources,has become an important network security tools.However,intrusion detection technology still has some shortcomings.Due to various flaws in the detection technology adopted by the current intrusion detection system and continious updating of various attack methods,the false alarm rate is high and the accuracy of intrusion detection needs to be further improved,the effect of monitoring large scale networks is not good.Aiming at the deficiency of traditional intrusion detection methods,a network anomaly detection model?DTRS_SVM?based on decision-making rough set and SVM algorithm is proposed.First of all,deal with experimental data,and then using the algorithm of SVM classify the test data.According to the sample points distance from the hyperplane interval,the data is divided into three classes of normal,abnormal,uncertain.Then,the data in the uncertain set is determined according to the method of decision-making rough set,and the probability of the equivalence set belongs to the normal set according to the minimum principle of decision risk.According to the range of probability,it is divided into three categories: normal,anomaly and boundary domain.Finally,for boundary domain set,a mixed classification model,obtained by the SVM algorithm and decision-theoretic rough set,is adopted to weighted average the results of the two methods,so that the data in the uncertain set belongs to normal or abnormal.In order to verify the classification effect of the above mixed classification model in network intrusion detection problem,the KDDcup99 dataset was used,based on the Matlab 2014 a platform,using Libsvm toolbox for experiment simulation.The kddcup_data₁0percent dataset was selected as the training set,and then the kddcup_data_corrected dataset was used as the test set to test the classification performance of the model,and compared with the traditional SVM algorithm,artificial neural network,K-nearest neighbor algorithm.The experimental results show that the hybrid classification model based on decisoin-theoretic rough set and SVM algorithm has the characteristics of high precision rate,recall rate and precision rate,the low rate of false alarm rate,so that the classification effect of the mixed model was verified.