Network intrusion detection method based on multi-class support vector machine

Based on heterogeneous value difference metric (HVDM), a radial basis function (RBF) named HVDM-RBF, was constructed to deal with heterogeneous network data directly. Using the experimental data, an improved HVDM-RBF was obtained as a new kernel function, I-HVDM-RBF, which decreases the number of support vectors and reduces the workload. The multi-class support vector machine was designed to detect network intrusion by using one-against-one method and I-HVDM-RBF. Defense Advanced Research Projects Agency intrusion detection evaluating data was used for detecting. The testing results show that the detection precision is increased by 3%, the number of support vectors and testing time are decreased about 268 and 5 minutes respectively by contrast with the Ambwani method and the detection precisions of denial-of-serve, remote-to-local, and user-to-root attacks are improved about 73%, 19% and 3% respectively compared with the method of Lee, which confirms the good performance of the proposed method.