Application of feature extraction method based on support vector machine in Internet of things

Abstract

Although much less fatal than the Ebola and previous SARS virus epidemics, the current coronavirus outbreak (COVID-19) has spread to more people in more countries in a much shorter time frame. With the rapid development of the Internet of things, it has played an important role to track/monitor transmission movements throughout the population. The technology infrastructure between mobile devices, wearable devices and sensors, smart home device makes it possible to readily deploy solutions to monitor and collect data and perform analysis to ensure policy make intelligent, rapid decisions. This research combines AOL and Support Vector Machine to form the Internet of things cycle through smart home. The parameters of Support Vector Machine model are optimized by ALO algorithm, which shortens the learning time and improves the performance of classifier. Then, the algorithm of ALO is used to optimize the Support Vector Machine intrusion detection method and agent technology, and the intrusion detection model is established. Experimental results show that the combination of these two can effectively reduce the false alarm rate of network intrusion.

Keywords

Support vector machine intrusion detection internet of things security smart home

1 Introduction

Although much less fatal than the Ebola and previous SARS virus epidemics, the current coronavirus outbreak (COVID-19) has spread to more people in more countries in a much shorter time frame. On March 11, 2020, the WHO has formally declared COVID-19 a global pandemic. Like many other outbreaks, COVID-19 faces serious challenges such as identifying the origin of the epidemic (or the patient zero), reducing the spread of the virus, and having enough medical resources to treat all the patients with severe symptoms.

With the rapid development of the Internet of things, it becomes an important role to track hospital equipment, trace the patients, and manage medical supply. Internet of things refers to the application of identity recognition technology and data perception technology to the object itself, and at the same time, it adopts data extraction algorithm to extract useful information, so as to control the number of information intelligently [1].

With the rapid development of Internet of things big data information technology, information extraction has gradually attracted more and more people’s attention. In life practice, using information extraction technology, we can extract effective information from big data little by little. Combined with Internet technology, we can collect and manage logarithmic data [2 –7]. Therefore, in the environment of Internet of things, we need to constantly improve the mining ability of data extraction and the recognition ability of data extraction, so as to obtain effective information. Therefore, the research on information extraction algorithm is of far-reaching significance to improve our information recognition ability and information control ability.

In recent years, radio frequency identification technology [8, 9] (such as radio frequency identification technology) has developed rapidly, people’s lives have been greatly facilitated, bringing considerable economic benefits to enterprises, but also more serious information security problems [10 –13].

Nowadays, with the continuous progress of Internet of things technology, smart home technology is one of the research hotspots of the Internet of things. The general so-called smart home environment refers to the smart home automation system. Smart home is the technology of monitoring home appliances through intelligent and coordinated network and technology, which is the embodiment of scientific and technological progress.

Because of the maturity of various technologies in the field of Internet of things, the number of intelligent systems will double. Smart home has appropriately impacted and solved the domestic needs of families all over the world, and also has a mature protocol stack architecture to manage communication and information exchange rules. And people will rely on intelligent system more and more, which shows the efficiency and convenience of smart home. But as each family living environment becomes more and more intelligent, the load is more and more complex, and also more and more dependent on smart home technology. Today, security and privacy requirements have been put in the second place, and the demand for adequate security mechanisms with the least personal intervention is growing. For example, connecting a TV or refrigerator to the Internet is now considered a normal situation, because it will make our life easier. But the single fact that such nodes are connected to the world of the Internet of things can create potential vulnerabilities, as there are still no enhanced standards to protect such devices. Because any new vulnerability on any newly connected device is a threat to the end user.

The significance of this paper is to design a smart home system to overcome the problem of poor interconnection caused by different communication protocols used by various home appliances and intelligent terminal devices. To solve the problem of unified access to the Internet of things due to the inconsistent platform architecture used by various home appliances and smart home terminal devices. At the same time, the ant lion optimization algorithm for this smart home system is designed to optimize the SVM intrusion detection method to ensure the security of this smart home system in terms of network intrusion, so as to make people’s life more convenient and make the home environment of the majority of users more intelligent.

2 Design of smart home system based on alljoyn

This paper puts forward and designs the smart home security system aiming at the security problems caused by the interconnection and intercommunication of heterogeneous equipment and the sharing of equipment information in the traditional home system. The system structure design is divided into three parts: standard client, equipment system bridge and home equipment. Firstly, based on the alljoyn framework with platform neutrality, this smart home platform designs a P2P based smart home middleware system platform including standard client, device system bridge and thin client mechanism frame [14]. After that is the realization of smart home control system. Finally, a lightweight client device thin client is proposed and designed. Compared with devices running standard clients, the advantages of thin clients are that they can improve the system by reducing memory, processor speed and power consumption, peripheral equipment and user interface, so as to reduce product cost and volume.

2.1 Detection based on support vector machine

Support vector machine (SVM) algorithm is the most suitable for the intrusion detection model of the smart home environment. Therefore, based on the general intrusion detection model, this paper uses SVM to build the intrusion detection model.

SVM classifier has good performance in nonlinear, small sample high dimensional data pattern recognition, so it has good applicability and generalization ability. SVM has the following characteristics and advantages:

SVM has a very strict deduction process. In theory, the core problem of SVM is found and solved, which lays a solid foundation for the study of machine learning method in small sample environment.

SVM has good extensive ability. SVM design learning machine adopts the principle of structural risk minimization, and compromises the empirical risk and confidence interval. Therefore, this method has good generalization ability.

The complexity of SVM algorithm is independent of the dimension of input samples. For linear problems, the dimension of input space is improved to facilitate the linear separability of the problem to be solved in high-dimensional input space, and the complexity of the algorithm does not increase with the increase of dimension. For the nonlinear problem, the nonlinear transformation is transformed into high-dimensional feature space, and the nonlinear discriminant function is obtained in the original space by using the constructed linear discriminant function. The complexity of the algorithm is independent of the dimension of the input sample. In addition, the selection of parameters is very important, which will directly affect the performance of support vector machine. The parameters of SVM include kernel function, kernel function parameter σ and penalty parameter C.

Support vector machine has many kernel functions, such as quadratic kernel function, Gaussian kernel function and radial basis function. In this paper, radial basis function is selected as the kernel function of support vector machine. In order to obtain better performance penalty factor C and radial basis function kernel parameter σ, trial calculation method is selected to determine the parameters. The following is the mathematical basis of support vector machine, because this is the basic understanding of support vector machine.

If the training sample (x_i, y_i) , i = 1, 2, ⋯ , l, x ∈ R, y = ±1, l is the number of samples, n is the sample dimension (input dimension). Then the optimal hyperplane is: $wx + b = 0$ (1)

The constraints are: $min {∥ w ∥}^{2} / 2$ $s, t, y_{i} ({wx}_{i} + b) - 1 \geq 0, i = 1, 2, \dots, l$ (2)

When the training sample set cannot be divided linearly, when the variable ξ_i is introduced, then: $min {∥ w ∥}^{2} / 2 + C \sum_{i = 1}^{l} ξ_{i}$ $s, t, y_{i} ({wx}_{i} + b) - 1 \geq 1 - ξ_{i}, ξ_{i} \geq 0, i = 1, 2, \dots, l$ (3)

Where: C is the penalty factor, and the size of C represents the penalty size of error classification. The Lagrange multiplier method is used to obtain the optimal decision function: $f (x) = sgn [\sum_{i = 1}^{l} y_{i} a_{i} (x \cdot x_{i}) + b]$ (4)

Where: a is the Lagrange coefficient. This scheme only aims at the non-zero part of a_i, and the corresponding sample is support vector. b is the classification threshold.

The nonlinear problem is changed into a linear problem: the problem is transformed into the problem of solving hyperplane in high dimensional space by nonlinear transformation. Then, by using RBF kernel function to complete the linear classification after nonlinear transformation on the basis of keeping the computational complexity, the optimal decision function is changed into: $f (x) = sgn [\sum_{i = 1}^{l} y_{i} a_{i} k (x \cdot x_{i}) + b]$ (5)

According to the previous description, we know that support vector machine classifier has its own difficulties, that is, support vector machine classifier is only suitable for small samples. For the problem of small sample size, SVM can successfully overcome some unavoidable shortcomings of other traditional machine learning algorithms in the training process, such as dimension disaster, over fitting and local minimization. In addition, the traditional support vector machine learning method can avoid the traditional network learning method due to the problems of small number of samples and long training time.

Therefore, this paper can refer to the general network intrusion detection model, as shown in Fig. 1 to design SVM intrusion detection model. Compared with the general network intrusion detection model, the event generator corresponds to the data collection part in the above figure. The event database and response unit parts in the network intrusion detection model correspond to the event database and the response general in the figure above. The other parts of the figure above correspond to the event analyzer in the general network intrusion detection model. In general, its working principle can be summarized as follows:

Firstly, the network data of the gateway in the smart home environment is collected through the data collection module. This part can capture the data packets of the gateway node through the existing software and hardware methods.

Feature extraction of the collected data, analysis of the captured network data of the smart home gateway node and extract the network data that meets the requirements of this paper. This part is completed by existing methods, such as data mining.

After feature extraction, the data format in the data set is transformed, and the complex data format and the inconsistent dimension in the data are transformed into a neat data format that can be processed by SVM.

Finally, the state of SVM is judged. If SVM has not completed the learning process, it needs to be trained with the data of training set. And input the obtained support vector into the support vector database; if SVM has successfully completed the learning process, then it uses the support vector in the support vector database to construct the classification discriminant function to classify the data, and then saves the classification results and the original data information into the event database, which is convenient for future review and maintenance of the network. The response module is the same as the response module in the general intrusion detection system model. According to the results of SVM, different solutions are produced.

Fig. 1

SVM intrusion detection model.

The implementation of support vector machine depends on the solution of convex quadratic programming. When facing a small number of samples, the analysis method and numerical optimization algorithm can also be used to solve the problem. On the premise of ensuring the accuracy, the optimized SVM algorithm can greatly reduce the training time of parallel learning (including the combination of various parts of large-scale data sets and the training results).

3 Intrusion detection model based on optimized SVM

An intrusion detection model based on SVM is established. But as mentioned above, the penalty factor and kernel function of SVM have an impact on the effect of SVM algorithm. Therefore, this paper selects ALO algorithm to optimize SVM algorithm, and obtains ALO optimized SVM algorithm, and then uses ALO optimized SVM algorithm to design intrusion detection method suitable for smart home environment.

3.1 Optimize SVM algorithm

ALO algorithm aims to simulate the hunting mechanism of ants in nature. Compared with particle swarm optimization (PSO), genetic algorithm (GA), bat algorithm (BA), cuckoo search (CS) and flower pollination algorithm (FPA), ALO algorithm has higher optimization accuracy, stronger global search ability and simpler parameter setting, which can be applied to all fields. ALO algorithm simulates the hunting mechanism of ants in nature. There are five main steps in hunting: random walking of ants, construction of traps, trapping of ants in traps, predation of prey and reconstruction of traps. It has the advantages of less adjustment parameters and high optimization accuracy. The principle of ALO algorithm model is as follows:

ALO algorithm simulates the interaction between ant lion and ant in the trap. In the search space, ants walk randomly to find prey, while ant lions use traps to catch ants. According to the way that ants walk randomly when searching for food, the movement formula of simulated ants in random walk is as follows: $x_{i} = [0, cumsum (2 r (t) - 1)]$ (6)

Where, cumsum is used to calculate the cumulative sum, t represents iteration, and r(t) is a random function, which is defined as follows: $r (t) = {\begin{matrix} 1, if (rand > 5) \\ 0, if (rand \leq) \end{matrix}$ (7)

Among them, T represents iteration, and Rand is uniformly distributed in [0,1] interval to generate random number.

In the optimization process, the position of ants is saved and utilized with the following matrix: $M_{Ant} = [\begin{matrix} A_{1, 1} & A_{1, 2} & \dots & A_{1, d} \\ A_{2, 1} & A_{2, 2} & \dots & A_{2, d} \\ ⋮ & ⋮ & ⋮ & ⋮ \\ A_{n, 1} & A_{n, 2} & \dots & A_{n, d} \end{matrix}]$ (8)

Where, M_ant is the matrix used to save the location of each ant, A_i,j is the location of the i ant i n the j dimension, n is the number of ants, and d is the dimension of variables. In the optimization process, the fitness function is used to evaluate the position of each ant, and the fitness value of each ant is saved with the following matrix. $M_{OA} = [\begin{matrix} f ([A_{1, 1}, A_{1, 2}, \dots A_{1, d}]) \\ f ([A_{2, 1}, A_{2, 2}, \dots A_{2, d}]) \\ ⋮ \\ f ([A_{n, 1}, A_{n, 2}, \dots A_{n, d}]) \end{matrix}]$ (9)

The MOA matrix is used to store the fitness value of each ant. f() is the fitness function, A_i . j is the position of the i ant i n the j dimension, n is the number of ants, and d is the dimension of variables.

In the ALO algorithm, if the ant lion is hidden in a certain place in the search range, the following matrix is used to save the position and fitness value of the ant lion. $M_{Antlion} = [\begin{matrix} {AL}_{1, 1} & {AL}_{1, 2} & \dots & {AL}_{1, d} \\ {AL}_{2, 1} & {AL}_{2, 2} & \dots & {AL}_{2, d} \\ ⋮ & ⋮ & ⋮ & ⋮ \\ {AL}_{n, 1} & {AL}_{n, 2} & \dots & {AL}_{n, d} \end{matrix}]$ (10)

Among them, M_antlion is the matrix used to save the position of each ant lion. AL_i,j represents the position of the i ant lion in the j dimension, n represents the number of ant lions, and d represents the dimension of variables. $M_{OAL} = [\begin{matrix} f ([{AL}_{1, 1}, {AL}_{1, 2}, \dots {AL}_{1, d}]) \\ f ([{AL}_{2, 1}, {AL}_{2, 2}, \dots {AL}_{2, d}]) \\ ⋮ \\ f ([{AL}_{n, 1}, {AL}_{n, 2}, \dots {AL}_{n, d}]) \end{matrix}]$ (11)

Among them, the M_OAL matrix is used to save the fitness value of each ant lion, f() is the fitness function, AL_i,j is the position of the i ant lion in the j dimension, n is the number of ant lions, and d is the dimension of variables.

The random walk is used in the search space to avoid crossing the boundary, the following equation (maximum and minimum normalization) is used for normalization: $x_{i}^{t} = \frac{(x_{i}^{t} - a_{i}) • (d_{i}^{t} - c_{i}^{t})}{b_{i} - a_{i}} + c_{i}$ (12)

Among them, ai represents the minimum random walk of the i variable, bi represents the maximum random walk of the i variable, $c_{i}^{t}$ represents the minimum random walk of the i variable in the t iteration, and $d_{i}^{t}$ represents the maximum random walk of the i variable in the t iteration; $c_{i}^{t} = {Antlion}_{i}^{t} + c^{t}$ (13) $d_{i}^{t} = {Antlion}_{i}^{t} + d^{t}$ (14)

Where ct is the minimum value of all variables in this iteration. dt is the maximum value of all variables in iteration t. $c_{i}^{t}$ is the minimum of all variables in the i-dimensional ant, and $d_{i}^{t}$ is the maximum of all variables in the i-dimensional ant. And ${Antlion}_{i}^{t}$ shows the location of the jth ant lion selected at iteration t. $I = 10^{w} \frac{t}{T}$ (15) $w = {\begin{matrix} 2, t > 0.1 T \\ 3, t > 0.5 T \\ 4, t > 0.75 T \\ 5, t > 0.9 T \\ 6, t > 0.95 T \end{matrix}$ (16)

Where t represents the number of current iterations, T represents the maximum number of iterations, and w is a constant defined based on the current iteration, which can adjust the accuracy of the search.

When the ant reaches the bottom of the pit, the ant lion catches the ant, which is the last stage of hunting. After this stage, the ant lion drags the ant into the bunker and eats it. To simulate this process, suppose that when ants enter the sand, ant lions begin to catch ants. Then an ant lion is required to update its position to the latest position of the ant being hunted to increase the chance of catching new prey. ${Ant}_{i}^{t} = \frac{R_{A}^{t} + R_{E}^{t}}{2}$ (18)

Among them, $R_{A}^{t}$ is the position where ants select an ant lion according to the fitness value of the previous generation ant lion population according to the roulette rules and swim around the ant lion randomly. $R_{E}^{t}$ shows the position of the elite ant lion after random walk in the t-th iteration. ${Ant}_{A}^{t}$ represents the position of the ant in the I-D of the t-th iteration.

During optimization, the following conditions should be met:

Ants are random walks in search space and the random walk mechanism is applicable to all dimensions of ants;

Ant’s random walk will be affected by ant lion trap;

Ant lions can construct traps that are directly proportional to their fitness (the higher the fitness, the greater the trap, the greater the probability of catching prey);

In each iteration, each ant can be caught by ant lion and elite ant lion;

In the process of simulating ants sliding to ant lion, the range of random walk will be reduced adaptively;

If the fitness value of ant is higher than that of ant lion, it means that it will be caught by ant lion;

After each hunt, the ant lion updates its position to the position of the ant to be hunted, so as to improve the probability of catching prey next time.

Detecting network-based attacks on the Internet is still a relevant and very challenging area to study. The focus of this study is to develop a framework, which combines the output of multiple learners to improve the efficiency of network intrusion detection. The built-in method in the framework is tested on the benchmark data set, which contains normal network data and multiple instances of network attacks. As recent research shows that SVM is directly available, SVM is chosen as the core algorithm. Support vector machine is one of the most widely used and best performance machine learning platforms. A novel and flexible machine learning framework is constructed.

The aim of this paper is to improve the speed of system detection on the basis of improving the detection rate.

The basic idea of the algorithmic optimization of SVM is to organize and normalize the input data. Then the parameters of SVM, namely penalty factor C and kernel function width σ, are optimized by using ALO algorithm, and the accuracy of network intrusion detection is taken as the fitness function. Finally, the processed data are tested in the established model. The implementation steps are as follows:

Data preprocessing, coding and sorting the collected data;

Initial ALO(c, σ), initial ant and ant lion population size n, set the maximum number of iterations T, d as the search space dimension. The maximum and minimum weighting factors ω_max, ω_min;

The fitness function is used to calculate the individual fitness value of each ant and ant lion to find the optimal ant lion and save it as the current elite individual. The accuracy of intrusion detection is substituted as the fitness function to calculate the fitness value;

Iteration. In the iterative process, the position of ants is updated, and the ant lion is selected by roulette;

Find out the fitness value and space position of the best ant lion;

Judge the end condition: the search ends when the iteration end condition is reached, otherwise (3);

After iteration, the optimal parameters of SVM are extracted, and the data after dimension reduction is trained by the optimal parameters;

Use test data to test the established model and output the results.

The purpose of the algorithm is to reduce the consumption of redundant data in the detection process, and to improve the detection rate on the basis of improving the detection speed.

4 Intrusion detection model based on ant lion optimized SVM

Through the introduction of the above theory, the performance of classifier in intrusion detection mainly depends on the selection of data features. The selection of kernel function and penalty parameter of SVM plays an important role in the performance of classifier. Therefore, we optimize the parameters of SVM when constructing the model, which not only shortens the training time, but also improves the performance of intrusion detection classifier. The overall design is shown in Fig. 2. The intrusion detection model is shown in Fig. 3.

Fig. 2

Using ALO to optimize the intrusion detection process of SVM.

Fig. 3

Intrusion detection model.

The intrusion detection method based on the algorithmic optimization of SVM can be divided into four parts.

Data acquisition stage: in this stage, the network data that needs to be analyzed is acquired and sorted out. Obtain the required raw data samples.

Data processing stage: because the type of network data is more complex, the data set is first processed numerically and normalized to eliminate the differences between different attributes. Due to the high dimension of data set used in intrusion detection, there are irrelevant and redundant attributes, so it is necessary to reduce the data dimension, reduce the number of calculations, and improve the detection accuracy.

Model training stage: in this stage, the support vector machine (SVM) feature selection and parameter optimization are carried out through the continuous iteration of ALO algorithm, and the classifier model is established.

Data check stage: the test data set after data processing is tested with the learned ALO optimized SVM classification model, and the decision response module makes corresponding decisions based on the results.

Then, according to the general intrusion detection system, the final intrusion detection framework is designed. General intrusion detection system framework consists of four modules: transaction generator, transaction analyzer, and response unit and transaction database. Based on the research of ant lion intrusion detection system framework and optimal support vector machine algorithm, an intelligent home intrusion detection model based on ant lion optimal support vector machine algorithm is proposed.

The agent in each module of the model can run in any physical location to take charge of specific tasks. In data analysis agent, data classification, event generation and primary warning generation are all needed. The first two are data preprocessing, and the ant colony optimization support vector machine algorithm is applied to the alarm generation of data analysis agent. Compared with PSO optimization SVM and DA optimization SVM, this algorithm has the characteristics of high detection rate, strong classification performance and high detection efficiency.

5 Experiment and result

In this paper, UNSW-NB15 data set is selected as the experimental data set of intelligent home intrusion detection system model based on ALO-SVM.

According to the experimental results, the intrusion detection technology is evaluated from the detection rate, detection accuracy, virtual alert rate, accuracy, virtual alert rate and detection time. Test time represents the actual CPU time IDS uses to classify all test connections. The parameters evaluated are: True Positive (TP) is an alarm that is predicted to be positive and actually positive, that is, a real attack triggers IDS to generate an alarm. False positive (False Positive, FP) events are predictions that are positive, but are actually negative, that is, false events that trigger IDS to issue an alarm when no actual attack occurs. False negative (False Negative, FN) is an event that is predicted to be negative and actually positive, that is, no actual attack has occurred and IDS has not issued an alarm. True negative (True Negative, TN) predictions are negative, and are actually negative events, that is, there are actually attacks and IDS does not issue an alarm. The following is their definition: $Accuracy = \frac{TP + TN}{TP + TN + FP + FN}$ (19) $Precision = \frac{TN}{TN + FP}$ (20) $Degree of accuracy = \frac{TP}{TP + FP}$ (21) $Underreporting rate = \frac{FN}{FN + TP}$ (22) $False alarm rate = \frac{FP}{TN + FP}$ (23)

The experimental process is divided into five steps:

Selection of input data set: Choose the right exercise set and experiment set. In this paper, unsw-nb15 data set is used as experimental data input. Due to the large number of data in the whole data set, this paper selects 10000 data in the training data set as the training set experiment, and selects 10000 pieces of data in the test set partition as the test set data of this experiment.

Data preprocessing: replace and adjust the attributes of the selected training set data and test set data, so that they can be converted into data that can be calculated by the tool. In this paper, can be removed from the selected data set. And convert the feature type to nominal.

Using training set for training: using training set SVM algorithm, ant lion optimization SVM algorithm, particle swarm optimization SVM algorithm, dragonfly optimization SVM algorithm.

Experiment with test set: use test set to test the trained classification model.

Results output: output and compare the results, evaluate the advantages and disadvantages of ant lion optimization SVM algorithm, particle swarm optimization SVM algorithm, dragonfly optimization SVM algorithm.

The experimental results in this paper are as follows:

In this paper, when the sample size is n = 30 and the maximum update times is t = 30, the support vector machine is optimized by using particle swarm optimization (PSO) particle swarm optimization (DA dragon fly optimization) and ant colony optimization (ALO ant lion optimization) respectively, and the unsw-nb15 data set is tested. It can be seen from Table 1 that the detection index of intrusion detection method optimized by ALO is better than that of particle swarm optimization SVM and dragonfly optimization SVM, which shows that in this experiment, ALO algorithm is better than PSO and Da algorithm, and improves the performance of SVM intrusion detection.

Table 1

Detection rate of three methods

Type	Accuracy of SVM optimized by ALO (%)	Accuracy of PSO optimized SVM (%)	Accuracy of DA optimized SVM (%)
Fuzzers	98.09	97.53	97.66
Analysis	99.12	96.27	96.15
Backdoors	98.57	97.93	97.54
DoS	99.99	99.35	99.10
Exploits	97.54	95.98	92.52
Generic	98.54	97.31	97.21
Reconnaissance	97.46	96.21	95.99
Shellcode	99.47	98.32	97.96
Worms	98.28	96.84	95.59

From the experimental results, it can be seen from Table 2 that the detection time of ALO optimized SVM algorithm is 4-5 times faster than PSO optimized SVM algorithm, and 3-4 times faster than Da optimized SVM algorithm. The experimental results show that the intrusion detection algorithm optimized by ALO-svm can meet the needs of real-time intrusion detection in smart home system.

Table 2

Detection time required by different detection methods

	ALO optimized SVM	PSO optimized SVM	DA optimized SVM
Time(s)	14.32	81.69	50.16

Table 3 shows that the detection accuracy and accuracy of SVM intrusion detection method based on ALO optimization are higher than those of the other two methods, and the rate of false positives and false positives is the lowest.

Table 3

Comparison of detection indexes of three methods

Type	ALO optimized SVM	PSO optimized SVM	DA optimized SVM
Accuracy rate	99.07	97.82	98.77
False alarm rate	0.63	2.34	2.39
Missing report rate	0.34	0.69	0.95
Precision	99.17	95.36	96.80

This proves that SVM intrusion detection method based on ALO optimization has good detection performance and can be used in smart home system.

6 Conclusions

This paper proposes an intrusion detection model based on support vector machine. Firstly, the mathematical principle of SVM algorithm is introduced, then according to the general intrusion detection model, the intrusion detection model based on SVM algorithm is established.

Aiming at the problem that penalty factor C and kernel function width σ have great influence on the detection performance of SVM, an optimization algorithm of SVM based on ALO is proposed. Its purpose is to select the kernel function and penalty parameter of SVM, which have an important influence on the performance of classifier. Therefore, in the construction of classifier, using ALO algorithm to optimize the parameters of SVM model can shorten the learning time and improve the performance of classifier. Then, using ALO optimization support vector machine intrusion detection method, using agent technology to build intrusion detection model and verify.

Finally, the performance evaluation criteria of ant lion optimization support vector machine based on unsw-nb15 data set are introduced. This test index includes six items to detect whether the intrusion detection model proposed in this paper can achieve the expected detection target.

This paper compares the intrusion detection methods of ALO optimized support vector machine with PSO optimized support vector machine and Da optimized support vector machine. Finally, the experiment shows that compared with PSO optimized SVM and Da optimized SVM, the intrusion detection method of ALO optimized SVM not only has higher detection accuracy, but also has higher detection efficiency, which can fully meet the requirements of intelligent home system for intrusion detection accuracy and real-time. It provides a new idea for smart home intrusion detection technology.

Acknowledgment

This work is supported by the research launch project of Mianyang Teachers’ College (Grant No. QD2018A006).

References

Duan

K.B.

, Rajapakse

J.C.

, Wang

, et al., Multiple SVM-RFE for gene selection in cancer classification with expression data, IEEE Transactions on Nanobioscience 4(3) (2005), 228–234.

Cherkassky

and Ma

, Practical selection of svm parameters and noise estimation for svm regression, Neural Networks 17(1) (2004), 113–126.

Routray

, Ray

A.K.

, Mishra

, et al., Efficient hybrid image denoising scheme based on SVM classification, Optik International Journal for Light & Electron Optics 157 (2018), 503–511.

Zheng

, Zhang

, Liu

, et al., A novel model based on wavelet LS-SVM integrated improved PSO algorithm for forecasting of dissolved gas contents in power transformers, Electric Power Systems Research 155(feb.) (2018), 196–205.

Zhang

, Song

, Jiang

, et al., Measurement of lumber moisture content based on PCA and GS-SVM, Journal of Forestry Research 29(02) (2018), 303–310.

Wang

, Li

, Feng

, et al., Hardware design of multiclass SVM classification for epilepsy and epileptic seizure detection, Iet Circuits Devices & Systems 12(1) (2018), 108–115.

Wang

and Song

, Water level prediction of rainwater pipe network using an SVM-based machine learning method, International Journal of Pattern Recognition and Artificial Intelligence 34(02) (2020), 597–613.

Barman

and Choudhury

N.B.D.

, Season specific approach for short-term load forecasting based on hybrid FA-SVM and similarity concept, Energy 174(MAY 1) (2019), 886–896.

Sun

X.J.

, Li

J.R.

, Gu

, et al., Identifying the characteristics of the hypusination sites using SMOTE and SVM algorithm with feature selection, Current Proteomics 14(2) (2018).

10.

Jun

H.U.

, Yan-De

, Xu-Dong

, et al., Quantitative determination of benzoic acid in flour based on terahertz time-domain spectroscopy and LS-SVM, Spectroscopy and Spectral Analysis, 2019.

11.

Roushangar

and Ghasempour

, Evaluation of the impact of channel geometry and rough elements arrangement in hydraulic jump energy dissipation via SVM, Journal of Hydroinformatics 21(1–2) (2019), 92–103.

12.

Jingting

, Hong

, et al., Correction: LMethyR-SVM: Predict Human Enhancers Using Low Methylated Regions based on Weighted Support Vector Machines. Plos One, 2019.

13.

Yan

and Jia

, A novel optimized SVM classification algorithm with multi-domain feature and its application to fault diagnosis of rolling bearing, Neurocomputing 313(NOV.3) (2018), 47–64.

14.

, Weng

, Xu

, et al., Support Vector Machines (SVM) classification of prostate cancer Gleason score in central gland using multiparametric magnetic resonance images: A cross-validated study, European Journal of Radiology 98 (2018), 61–67.