Abstract:

Network anomaly behavior detection is the important section of the intrusion detection, and it is hard for single security measure to attain good detection result. According to the evidence combination problem of highly conflict evidences, the paper applies an improved combination method based on weight to network anomaly behavior detection, and builds an intrusion detection model with multiple SVM classifiers. The method uses average evidences and weight value to distinguish the importance among all evidences, and thus it can deal with the conflicting evidences. Simulation results show that, compared with the traditional DS theory, the proposed model can effectively improve the integration efficiency, thereby improving detection performance.

Key words: anomaly intrusion;SVM;DS evidence theory;fusion