SVM Intrusion Detection Model Based on Compressed Sampling

Table 1

Detection result of the support vector machine (SVM) as the classifier.

Detection type		Normal	Probe	Dos	U2R	R2L
Noncompressed sampling	Detection rate (%)	98.73	97.34	99.27	94.21	99.35
	False positive rate (%)	0.87	1.03	0.92	1.08	0.92
Compressed sampling
Gaussian random matrix	Detection rate (%)	98.23	96.42	97.08	90.37	97.64
	False positive rate (%)	0.82	1.19	0.96	1.26	0.98
Random Bernoulli matrix	Detection rate (%)	97.31	97.07	99.14	88.39	98.71
	False positive rate (%)	1.13	1.21	1.07	1.86	0.92
Partial Hadamard measurement matrix	Detection rate (%)	98.12	96.94	98.71	90.84	97.75
	False positive rate (%)	0.93	1.05	0.92	1.49	1.04
Toeplitz matrix measurement	Detection rate (%)	97.86	96.93	98.49	89.15	98.73
	False positive rate (%)	0.88	1.06	0.91	2.12	0.94
Structure random matrix	Detection rate (%)	96.57	96.72	97.87	87.35	98.76
	False positive rate (%)	1.15	1.23	0.97	2.34	0.96
Chirp measurement matrix	Detection rate (%)	97.33	96.24	98.39	90.08	99.01
	False positive rate (%)	1.08	1.33	1.15	1.13	0.94

(i) Probe: surveillance or probe, (ii) DoS: Denial of Service, (iii) U2R: User to Root, and (iv) R2L: Remote to Local.