一种基于聚类的有指导的入侵检测方法  

Clustering-Based and Supervised Intrusion Detection Method

作　　者：蒋盛益[1] 李庆华[1] 王卉[1] 孟中楼[1] 

机构地区：[1]华中科技大学计算机学院

出　　处：《小型微型计算机系统》2005年第6期1042-1045,共4页Journal of Chinese Computer Systems

基　　金：国家自然科学基金项目(60273075)资助.

摘　　要：提出了一种新的距离定义和基于聚类的有指导的入侵检测方法CBSID(Clustering-basedandSupervisedInterusionDetection),该方法在带标记的训练集上进行聚类,以聚类结果作为分类模型对未见数据进行分类.该方法对于参数和数据输入顺序具有稳健性,可增量更新分类模型.不同于一般的有指导的入侵检测方法,该方法对未知入侵有一定的检测能力.在KDDCUP99数据集上的测试结果表明,CBSID有理想的性能(高的检测率和低的误报率).A clustering-based and supervised intrusion detection method,named CBSID(Clustering-based and Supervised Interusion Detection) with new distance defination is proposed in this paper. CBSID clusters training data by the label and the results of clustering are used as classification model to predict which cluster the current data belongs to.The method is robust to the cluster parameter and the input sequence of data. The classifiaction model may be incremental updated.Compared with the most existing supervised intrusion detection methods, this method can detect unknown intrusions.The experiment results on dataset KDDCUP99 demonstrate that the CBSID has promising performance with high detection rate and low false alarm rate.

关 键 词：入侵检测 聚类 分类 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]