SVM-KNN Network Intrusion Detection Method Based on Incremental Learning
摘要
In order to meet the requirements of intrusion detectionfor real-time performance and accuracy,this paper designs an IL-SVM-KNN classifier that combines Support Vector Machine(SVM) and K-Nearest Neighbor(KNN) algorithm,and the balanced k-dimensional tree is used for data structure to improve the execution speed.In the training phase,the idea of incremental learning is applied and the expansion of the knowledge base is considered.In the classification phase,the SVM algorithm and KNN algorithm are used to divide the to-be-classified data into three cases,each case with a unique classification strategy.Experimental results on KDD CUP99 and NSL-KDD datasets show that the IL-SVM-KNN classifier can distinguish abnormal traffic from normal traffic,and determine the type of abnormal traffic attacks.The accuracy of the proposed classifier is significantly improved compared with the KNN algorithm and SVM algorithm.It also outperforms the decision tree,random forests and XGBoost algorithm in terms of the accuracy of determining the attack type while reducing the elapsed time and resource consumption compared with two-layer convolution neural network.