基于半监督聚类的网络入侵检测算法

入侵检测是维护网络安全的重要技术手段之一.本文提出一种聚类算法:k-cubes,用于网络异常检测.算法采用基于网格的方法对网络连接数据进行预处理,然后以网格为数据处理单位进行聚类,在聚类过程中通过动态合并与分裂自动决定聚类的数目.在此基础上给出了半监督k-cubes聚类算法,并根据聚类的结果生成检测规则.k-cubes聚类算法适合处理高维并且含有多值字符属性的大数据量数据,同时具有输入参数少等特点.在KDD99入侵检测数据集上的实验结果显示,算法获得95.82%的检测率和1.25%的误报率,并且在识别新入侵的能力上,算法检测到17种新入侵中的15种.

A Semi-supervised Clustering Algorithm for Network Intrusion Detection

Intrusion detection is one of the most important techniques in the domain of network security.This paper proposes a novel clustering algorithm,named k-cubes,for network anomaly detection.The network connection data are preprocessed with a grid-based algorithm.Then the grid cells are clustered with the proposed method.The number of clusters is automatically decided by dynamically merging and splitting of clusters.Also the semi-supervised version of k-cubes is presented.Detection rules are produced according ...