摘要
入侵检测是维护网络安全的重要技术手段之一。本文提出一种聚类算法:k-cubes,用于网络异常检测。算法采用基于网格的方法对网络连接数据进行预处理,然后以网格为数据处理单位进行聚类,在聚类过程中通过动态合并与分裂自动决定聚类的数目。在此基础上给出了半监督k-cubes聚类算法,并根据聚类的结果生成检测规则。k-cubes聚类算法适合处理高维并且含有多值字符属性的大数据量数据,同时具有输入参数少等特点。在KDD99入侵检测数据集上的实验结果显示,算法获得95.82%的检测率和1.25%的误报率,并且在识别新入侵的能力上,算法检测到17种新入侵中的15种。
Intrusion detection is one of the most important techniques in the domain of network security. This paper proposes a novel clustering algorithm, named k-cubes, for network anomaly detection. The network con- nection data are preprocessed with a grid-based algorithm. Then the grid cells are clustered with the proposed method. The number of clusters is automatically decided by dynamically merging and splitting of clusters. Also the semi-supervised version of k-cubes is presented. Detection rules are produced according to the clustering result. This method is suitable for processing large amount of high dimensional datasets with a lot of symbolic attribute values. It also limits the number of inputting parameters. Experimental results on the KDD99 intrusion detection datasets show that our algorithm achieves a detection rate of 95. 82% with a false positive rate of 1.25%, and it detects 15 out of 17 new type of intrusions.
出处
《铁道学报》
EI
CAS
CSCD
北大核心
2010年第1期49-53,共5页
Journal of the China Railway Society
基金
北京市教育委员会共建项目(353011535)
关键词
网络异常检测
半监督聚类
基于网格的聚类
network anomaly detection
semi-supervised clustering
grid-based clustering
