基于对支持向量机的多类分类算法在入侵检测中的应用

针对基于传统支持向量机(SVM)的多类分类算法在处理大规模数据时训练速度上存在的弱势，提出了一种基于对支持向量机(TWSVM)的多类分类算法。该算法结合二叉树SVM多类分类思想，通过在二叉树节点处构造基于TWSVM的分类器来达到分类目的。为减少二叉树SVM的误差累积，算法分类前首先通过聚类算法得到各类的聚类中心，通过比较各聚类中心之间的距离来衡量样本的差异以决定二叉树节点处类别的分离顺序，最后将算法用于网络入侵检测。实验结果表明，该算法不仅保持了较高的检测精度，在训练速度上还表现了一定优势，尤其在处理稍大规模数据时，这种优势更为明显，是传统二叉树SVM多类分类算法训练速度的近两倍，为入侵检测领域大规模数据处理提供了有效参考价值。

Application of multi-class classification algorithm based on twin support vector machine in intrusion detection

The multi-class classification algorithms based on traditional Support Vector Machine (SVM) are weak on training speed when dealing with large-scale data. To solve the problem, this paper proposed a multi-class classification algorithm based on Twin Support Vector Machine (TWSVM). It combined binary tree multi-class classification and constructed classifiers based on TWSVM on the nodes of binary tree. To reduce the error accumulation of Binary Tree SVM (BT-SVM), it firstly got clustering centers through the clustering algorithm, and then compared the distances between them to determine the separation sequence of classes. Finally, it was applied to network intrusion detection. The experimental results show that the proposed algorithm has higher detection accuracy and certain advantages on training speed especially for large-scale data. The training speed is approximately two times faster than that of the traditional BT-SVM algorithm. It is valuable for large-scale data processing in the field of network intrusion detection.