摘要
网络入侵检测算法是网络安全领域研究的热点和难点内容之一。目前许多算法如KNN、TCMKNN等处理的训练样本集都比较小,在处理大样本集时仍然非常耗时。因此,提出了一种适应大样本集的网络入侵检测算法(Cluster-KNN算法)。该算法分为离线数据预处理(数据索引)和在线实时分类两个阶段:离线预处理阶段建立大样本集的聚簇索引;在线实时分类阶段则利用聚簇索引搜索得到近邻,最终采用KNN算法得出分类结果。实验结果表明:与传统的KNN算法相比,Cluster-KNN算法在分类阶段具有很高的时间效率,同时在准确率、误报率和漏报率方面与其它同领域入侵检测方法相比也具有相当的优势。Cluster-KNN能够很好地区分异常和正常场景,且在线分类速度快,因而更适用于现实的网络应用环境。
Network intrusion detection algorithm is one of the hot and difficult topics in the field of network security research.At present,many algorithms like KNN and TCMKNN,which process relatively small data samples,are still very time-consuming when processing large scale date set.Therefore,this paper put forward a hybrid algorithm （ClusterKNN）,which is adaptive to large scale data set.The algorithm is divided into the offline data preprocess phase（data indexing） and the online real-time classification phase.The offline phase establishes the cluster index for the large data set.Then the online phase uses the index to search neighbors,and finally outputs the result by KNN algorithm.The experimental results show that compared with the traditional KNN algorithm,Cluster-KNN algorithm has high time efficiency in the classification phase,and it has considerable advantages as well compared to intrusion detection methods of the same field in the accuracy rate,false positive rate,false negative rate and other aspects.Cluster-KNN can clearly distinguish the abnormal and normal scenes,and it has a high online classification speed.Thus,it is more suitable for the real network application environment.
出处
《计算机科学》
CSCD
北大核心
2016年第3期158-162,共5页
Computer Science
基金
广东省教育部产学研结合项目(2009B090300326)
华南师范大学研究生科研创新基金项目资助
