基于PCA和KPCA特征抽取的SVM网络入侵检测方法

提出一种新颖的基于特征抽取的异常检测方法,应用主分量分析(PCA)和核主分量分析(KPCA)抽取入侵特征,再应用支持向量机(SVM)检测入侵。其中PCA对输入特征做线性变换,而KPCA通过核函数进行非线性变换。利用KDD 99数据集,将PCA-SVM、KPCA-SVM与SVM、PCR、KPCR进行比较,结果显示:在不降低分类器性能的情况下,特征抽取方法能对输入数据有效降维。在各种方法中,KPCA与SVM的结合能得到最优入侵检测性能。

PCA/KPCA Feature Extraction Approach to SVM for Anomaly Detection

Feature selection and feature extraction are two kinds of dimensionality reduction techniques to boost classifiers' performance.Very little work on feature extraction is taken in the field of network anomaly detection.This paper applies principal component analysis(PCA) and kernel prncipal component analysis(KPCA) to network intrusion feature extraction.The extracted features are employed by SVM for classification.PCA linearly transforms the original inputs into new uncorrelated features while KPCA is an nonlinear generalization of the linear PCA using the kernal method.The MIT's KDD Cup 99 dataset is used to evaluate these feature extraction methods,and classification performances achieved by SVM with PCA and KPCA feature extraction are compared with those obtained by principal component regression(PCR) and kernel principal component regression(KPCR) classification methods and by SVM without(application) of feature extraction.The results clearly demonstrate that feature extraction can greatly reduce the dimensionality of feature space witout degrading the claaifiers' performance.Among these methods,the best performance is achieved by SVM using only the first four principal components extracted by(KPCA.)