A cooperative intrusion detection system based on improved parallel SVM

It is important that the training time of the Support Vector Machine (SVM) is shortened and storage space requirement is reduced for high-speed and large-scale network. An intrusion detection method based on parallel SVM is proposed and a detection model system is constructed in this paper. First, original training dataset gained from network is divided into three subsets according to the network protocol (TCP, UDP and ICMP). Second, every subset is parted into multi-subsets and sent to parallel SVMs. Then we get multiple results from SVM trainers. The incremental learning algorithm of SVM is used to train new data sets instead of reconstructing SVM for whole data. This method improves the training efficiency by reducing the size of training subsets. At last, simulation experiments are done with KDD CUP 1999 data set. The experiment results show that the training time of SVM is shortened and the detection accuracy obtained by our method is exactly same as that obtained by others.