A framework for distributed incremental intrusion detection based on SVM

In order to share the knowledge of intrusion among distributed hosts and make the intrusion detect packages more efficient and reliable, a framework of distributed incremental intrusion detection based on SVM is proposed in the study. In this framework, the locate SVM detects the local attacks and take charge of collecting the new typical samples. A center SVM summarizes the distributed samples and incorporates them to build the incremental SVM for locals. The simulation experiments with KDD Cup 1999 data demonstrate that our proposed method achieves the increasing performance for intrusion detection. The framework is valuable to design distributed intrusion detection system.