摘要
通常,在入侵检测的研究中把入侵行为看成是一个二分类问题,即正常和异常,这就需要一个被完全标记为正常和异常的训练数据集。而在实际应用中,很难找到这样的数据集,并且对于一些新的没有标记过的入侵行为,传统的入侵检测方法不能检测出来。而基于OCSVM的入侵检测不需要任何标记数据,并且能够从未标记的数据集中发现异常。
Generally, intrusion behavior is regarded as a two-class problem in the research on intrusion detection, which includes normal and abnormal. It needs a training set of pure data which is labeled as normal and abnormal. But in practice, it is hard to find this data set, and traditional intrusion detection approaches can not detect some new intrusion behaviors which have not been labeled before. However, OCSVM-based intrusion detection approaches do not need any labeled data set, and attempt to find anomaly buried in the data.
出处
《计算机与现代化》
2007年第3期40-44,共5页
Computer and Modernization
