Incremental SVM based on reserved set for network intrusion detection

We develop an improved incremental SVM algorithm, named RS-ISVM, to deal with network intrusion detection. To reduce the noise generated by feature differences, we propose a modified kernel function U-RBF, with the mean and mean square difference values of feature attributes embedded in kernel function RBF. Then, given the oscillation problem that usually occurs in traditional incremental SVM's follow-up learning process, we present a reserved set strategy which can keep those samples that are more likely to be the support vectors in the following computation process. Moreover, in order to shorten the training time, a concentric circle method is suggested to be used in selecting samples to form the reserved set. Academic researches and data experiments show that RS-ISVM can ease the oscillation phenomenon in the learning process and achieve pretty good performance, meanwhile, its reliability is relative high. (C) 2010 Elsevier Ltd. All rights reserved.