Method of Reducing False Positive Alerts Based on Support Vector Machine in Intrusion Detection
Chongzhao Han · Jisuanji gongcheng · 2006
Support vector machine (SVM) is used to deal with alerts produced by intrusion detection system to reduce false positive alerts.A similar radial basis function,which is based on heterogeneous value difference metric and can exactly measure the distance of heterogeneous value,is applied due to the heterogeneous alert data.The experimental data is the alerts produced by Snort,a kind of network intrusion detection system,with the attack and normal data in testing environment.Six background attributes are added to the experimental data to enhance the accuracy of classification.The testing results confirm the good performance of this method:at the cost of false negative alerts not increased,true positive ratio is 100%,reduced false positive ratio is 99.729 1%,and the processing time of each data is 0.38ms.