From the viewpoint of sparseness representation building of least squares support vetor machine(LSSVM), a novel sparse LS-SVM is presented for the modeling of network intrusion detection. The proposed sparse LS-SVM may be constructed via two methods, i.e., the iteration elimination according to the sorted value of model coefficients; the kernel space approximation method to construct the low rank subset approximation of training dataset that is applied for the training of LS-SVM to achieve sparseness and to improve the intrusion detection response speed. The proposed sparse LS-SVM is illustrated via MIT KDD 99 dataset and the results show that a better performance can be achieved in comparison to LS-SVM.

To overcome the deterioration of generalization ability caused by individual SVM and the problem of unbounded error begotten by using one-against-rest combination of SVM in multi-class classification,a Bagging based multi-class SVM(ensemble) model is constructed and applied to the MIT KDD 99 dataset to perform the simulation experiment.In the simulation experiment,the performance of SVM (ensemble) are evaluated by choosing the training sample number and the number of base classifiers,and then comparison with the individual classifier using all training data and using sampled training data.The result demonstrates that the Bagging based SVM ensemble algorithm can depress the complex of computation in classifier with all training data and improve the detection rate;Moreover,it can avoid the instability and the low precision in classifier with sampled training data.

Regularized Least-Squares Classification(RLSC) is a kind of kernel-based square loss regularization network,and its generalization performance is severely influenced by the setting of its kernel and hyper parameters.A novel approach named AlignLoo is presented for optimal parameters selection,and the key of this approach lies in tuning the kernel parameter and hyper parameter sequentially.First,the optimal kernel parameter is selected by maximizing kernel target alignment,and then the optimal hyper-parameter is determined via minimizing RLSC's leave-one-out error bound.The experimental results on IDA benchmark datasets demonstrate that the proposed approach is superior to traditional grid search method in that it is much more time efficient and it needs no independent validation set.

In the proposed algorithm,every particle in the swarm stands for a selected subset of features.The fitness of particle is defined as the correct classification percentage by SVM using a training set whose patterns are represented using only the selected subset of features.Thus through particle swarm optimization to achieve intrusion feature selection and classification.A probabilistic mutation of BPSO is adopted to avoid local optimal and a tabu search table is used to enlarge particle swarm’s search space and avoid repeated computation.The results of experiment demonstrate that applying a hybrid of BPSO-SVM in intrusion detection System can be an effective way for feature selection and detecting intrusions via using the data sets of KDD cup 99.

For least squares support vector machines (LS-SVM) based intrusion detection method, there is a big obstacle that the amount of audit data for modelling is very large even for a small network scale, so it's impractical to directly train LS-SVM using original training datasets. Furthermore, LS-SVM adopts equality constraints and squared functions, which leads to solve an easy-to-compute linear system, however followed is the lack of sparseness, all training data will become the support vector of LS-SVM, which cause the low intrusion detection speed. This paper proposed a novel LS-SVM intrusion detection model using kernel space approximation through greedy searching, thus constructed a subspace basis of original space populated by training data. Through this approximation, the training data was downsized and consequently the number of support vectors of ultimate LS-SVM model were reduced, which greatly helped to improve the response time of intrusion detection. The kernel-target alignment method was utilized to obtain optimal Gaussian kernel parameter and 10-fold cross-validate method to obtain optimal trade-off parameter. The MIT's KDD Cup 99 dataset was used to evaluate our present model, and the results clearly demonstrate that the method can be an effective way for fast intrusion detection

Feature selection and feature extraction are two kinds of dimensionality reduction techniques to boost classifiers' performance.Very little work on feature extraction is taken in the field of network anomaly detection.This paper applies principal component analysis(PCA) and kernel prncipal component analysis(KPCA) to network intrusion feature extraction.The extracted features are employed by SVM for classification.PCA linearly transforms the original inputs into new uncorrelated features while KPCA is an nonlinear generalization of the linear PCA using the kernal method.The MIT's KDD Cup 99 dataset is used to evaluate these feature extraction methods,and classification performances achieved by SVM with PCA and KPCA feature extraction are compared with those obtained by principal component regression(PCR) and kernel principal component regression(KPCR) classification methods and by SVM without(application) of feature extraction.The results clearly demonstrate that feature extraction can greatly reduce the dimensionality of feature space witout degrading the claaifiers' performance.Among these methods,the best performance is achieved by SVM using only the first four principal components extracted by(KPCA.)

Every individual in the swarm of swarm intelligence (SI) produces a feature subset candidate, the fitness of each individual is defined as the correct classification percentage by SVM using a training set whose patterns are represented using only the selected subset of features. Through SI optimization, intrusion feature selection and classification were achieved. Particle swarm optimization (PSO) and ant colony optimization (ACO) algorithm were adopted to the implementation of SI. The results of experiment demonstrate that applying SI-SVM in intrusion detection is an effective way for feature selection and detection via using the KDD cup 99 dataset.

This paper proposes a novel intrusion detection approach by applying kernel principal component analysis (KPCA) for intrusion feature extraction and followed by support vector machine (SVM) for classification. The MIT’s KDD Cup 99 dataset is used to evaluate these feature extraction methods, and classification performances achieved by SVM with PCA and KPCA feature extraction are compared with those obtained by PCR and KPCR classification methods and by SVM without application of feature extraction. The results clearly demonstrate that feature extraction can greatly reduce the dimension of input space without degrading the classifiers’ performance. Among these methods, the best performance is achieved by SVM using only four principal components extracted by KPCA.

Very little research on feature extraction has been taken in the field of network intrusion detection. This paper proposes a novel method of applying principal component neural networks for intrusion feature extraction, and then the extracted features are employed by SVM for classification. The adaptive principal components extraction (APEX) algorithm is adopted for the implementation of PCNN. The MIT’s KDD Cup99 dataset is used to evaluate the proposed method compared to SVM without application of feature extraction technique, which clearly demonstrates that PCNN-based feature extraction method can greatly reduce the dimension of input space without degrading or even boosting the performance of intrusion detection system.

Regularized Least-Squares Classification (RLSC) can be regarded as a kind of 2 layers neural network using regularized square loss function and kernel trick. Poggio and Smale recently reformulated it in the framework of the mathematical foundations of learning and called it a key algorithm of learning theory. The generalization performance of RLSC depends heavily on the setting of its kernel and hyper parameters. Therefore we presented a novel two-step approach for optimal parameters selection: firstly the optimal kernel parameters are selected by maximizing kernel target alignment, and then the optimal hyper-parameter is determined via minimizing RLSC’s leave-one-out bound. Compared with traditional grid search, our method needs no independent validation set. We worked on IDA’s benchmark datasets using Gaussian kernel, the results demonstrate that our method is feasible and time efficient.

This paper proposes a novel intrusion detection approach by applying ant colony optimization for feature selection and SVM for detection. The intrusion features are represented as graph-ere nodes, with the edges between them denoting the adding of the next feature. Ants traverse through the graph to add nodes until the stopping criterion is satisfied. The fisher discrimination rate is adopted as the heuristic information for ants' traversal. In order to avoid training of a large number of SVM classifier, the least square based SVM estimation is adopted. Initially, the SVM is trained based on grid search method to obtain discrimination function using the training data based on all features available. Then the feature subset produced during the ACO search process is evaluated based on their abilities to reconstruct the reference discriminative function using linear least square estimation. Finally SVM is retrained using the train data based on the obtained optimal feature subset to obtain intrusion detection model. The MIT's KDD Cup 99 dataset is used to evaluate our present method, the results clearly demonstrate that the method can be an effective way for intrusion feature selection and detection.

目前基于机器学习的入侵检测研究都是从提高检测精度的分类器算法设计出发,大多未考虑对样本特征的分析.文章提出了一种基于特征抽取的异常检测方法,应用主元神经网络(PCNN)抽取入侵特征,再应用SVM检测入侵.采用广义Hebb学习规则训练线性主元神经网络,SVM采用基于网格粒度搜索获得最优参数.利用KDD99数据集,将线性PCNN-SVM与SVM进行比较,结果显示在不降低分类器性能的情况下,PCNN特征抽取方法能对输入数据有效降维.

Simulation research on the extension adaptive control of single type inverted pendulum was presented. Firstly, the matter element (ME) model of inverted pendulum was built up, its qualified field, extension field and node field were determined, and the dependent function of state matter element was developed. Then, the extension adaptive control strategy based on the Lyapunov method was designed. Simulation results show that the proposed extension adaptive control to the pendulum is effective.