Capture the drifting of normal behavior traces for adaptive intrusion detection using modified SVMS

To capture the drifting of normal behavior traces for suppressing false alarms of intrusion detection, an adaptive intrusion detection system AID with incremental learning ability is proposed in this paper. A generic framework, including several important components, is discussed in details. One-class support vector machine is modified as the kernel algorithm of AID, and the performance is evaluated using reformulated 1998 DARPA BSM data set. The experimental results indicate that the modified SVMs can be trained in a incremental way, and the performance outperform that of the original ones with fewer support vectors (SVs) and less training time without decreasing detection accuracy. Both of these achievements benefit an adaptive intrusion detection system significantly.