Online Training of SVMs for Real-time Intrusion Detection

Abstract-- As intrusion detection essentially can be formulated as a binary classification problem, it thus can be solved by an effective classification technique-Support Vector Machine(SVM). Additionally, some text processing techniques can also be employed for intrusion detection, based on the characterization of the frequencies of the system calls executed by the privileged programs. Based on the intersection of these two research domains, i.e. pattern recognition and text categorization, and breaking the strong traditional assumption that training data for intrusion detectors are readily available with high quality in batch, the conventional SVM, Robust SVM and one-class SVM have been modified respectively based on the idea from Online SVM in this paper, and their performances are compared with that of the original algorithms. After elaborate theoretical analysis, concrete experiments with 1998 DARPA BSM data set collected at MIT's Lincoln Labs are carried out. These experimen...

• Type: Conference
• Year: 2004
• Where: AINA
• Authors: Zonghua Zhang, Hong Shen
• Keywords: AINA 2004, Computer Networks, Intrusion Detection, Intrusion Detection System, Text Categorization