Data Fusion Detection Model Based on SVM and Evidence Theory

Based on Dempster-Shafer (D-S) evidence theory of data fusion technology, a new intrusion detection system (IDS) model with C-SVM classifier is proposed. This model consisted of three SVM classifiers, which sorted out Normal, DoS, U2R, R2L and Probing behaviors from network connections according to basic TCP features, content features and traffic features. Those classified results were obtained through Dempter-Shafer's rule of combination, consequently intrusion recognitions were implemented. The experimental result proves that our method effectively decreases the false positive rate and the false negative rate, and increases the accuracy and precision of detection.