A hybrid intrusion detection system

摘要: Anomaly intrusion detection normally has high false alarm rates, and a volume of alarms will prevent system administrators identifying the real attacks. Machine learning methods provide an effective way to decrease rate improve anomaly detection. In this research, we propose novel approach using kernel Support Vector (SVM) for improving detectors' accuracy. Two kernels, STIDE Markov Chain kernel, are developed specially applications. The experiments show based two class SVM detectors have better accuracy than original detectors. Generally, approaches build normal profiles from labeled training data. However, data is expensive not easy obtain. We approach, one SVM, that does need To further increase lower rate, integrating specification with also proposed. This research establish platform which generates automatically both misuse software agents. our method, SIFT representing converted Colored Petri Net (CPNs) template, subsequently, CPN compiled into code agents compiler dynamically loaded launched On other hand, model profile generated data, agent carries By engaging agents, can detect known attacks as well unknown