# A New Method of Fuzzy Support Vector Machine Algorithm for Intrusion Detection
## 1 Introduction  
Intrusion detection systems (IDS) are essential to information security. IDS can be divided into signature-based IDS and anomaly-based IDS [1]. Both are based on pattern detection. Signature-based IDS matches the system behavior against the known attack and lacks the ability to detect zero-day attack. Anomaly-based methods construct normal behavior based on prior knowledge and judge the deviation between the current behavior and the normal behavior [2]. The advantage of the anomaly-based method is the ability to detect new attacks. A system call requested by an application is a function built into the operation system kernel. A system call sequence is a detailed account of the system calls occurring on a host. The behavior of an application can be described in terms of the sequence of system calls. It is easy to get the system call sequence in real-time. Therefore, the data of a system call sequence is often used as audit data for analysis and classification of malicious processes. The current methods of anomaly detection are based on traditional statistics, which is the study of the asymptotic theory. That is, the limit property can be reached when the number of samples approaches infinity. In intrusion detection systems, the observation samples are limited or even a small number. This cannot satisfy the preconditions of a detection method based on traditional statistics. As a result, the false alarm rate and missing rate are high. The algorithms of a system call in anomaly-based IDS need a lot of data. This is because these algorithms are based on traditional statistics, which is the study of the asymptotic theory. That is, the limit property can be reached when the number of samples approaches infinity. Unfortunately, the anomaly data in the intrusion detection system is very limited. Therefore, we classify system calls using an SVM-based algorithm, which is based on statistical learning theory. Statistical learning theory makes the SVM-based classifier only depend on a small part of the support vectors (SVs). This is very helpful for the training of classifiers with insufficient data. SVM-based algorithm, like the other algorithm, also has an inherent shortcoming, that is, it is sensitive to noises and outliers. In order to distinguish noises near the boundary from SV, fuzzy support vector machine is proposed to solve the problem. Because there are no uniform guiding principles, the existing FSVM-based algorithms are inconsistent with reality when classifying system call sequences. Therefore, the purpose of our paper is to construct a fuzzy support vector machine that is suitable for classifying system call sequences. Support vector machine [3; 4; 5; 6], as a machine learning method based on statistical learning theory, derives from the idea of the dual form to solve the large dimensional problems, makes the classifier only depend on a small part of the support vectors, implements the structural risk minimization principle in statistical learning theory, and solves the problems of nonlinearity and local minima. A system call sequence can be converted into a vector in a high dimensional space by the frequency of short system call sequences of a certain length. Therefore, abnormal detection can be carried out based on SVM. There are always noises and outliers in solving practical engineering applications due to statistical methods, human error and other factors. These noises and outliers cannot satisfy the precondition that all samples are independent and identically distributed. The noises and outliers near the boundary play the same role as SVs in constructing the optimal classification hyperplane. To solve this problem, researchers proposed fuzzy support vector machine (FSVM), that is, different weights are assigned to different samples, so that different samples contribute differently to the optimal classification hyperplane. In order to eliminate the influence of noises and outliers, the small weights are given to these samples.