聚类算法在入侵检测中的应用  

Clustering Algorithm for Intrusion Detection

作　　者：武艳[1] 彭新光[1] 

机构地区：[1]太原理工大学计算机与软件学院,太原030024

出　　处：《电脑开发与应用》2007年第8期6-7,10,共3页Computer Development & Applications

基　　金：山西省自然科学基金资助项目(20041047)

摘　　要：入侵检测中对未知入侵的检测主要由异常检测完成,传统的异常检测方法需要构造一个正常行为特征轮廓的参考模型,但获取完全正常的数据比较困难。介绍的聚类技术是应用到入侵异常检测中的一种较为新颖的技术,是一种无需指导的异常检测技术,可以区分哪些是正常记录,哪些是异常记录。分析了将聚类方法应用于入侵检测中的可行性及对数据处理的标准化方法。另外,给出了基于覆盖的聚类算法与两种经典聚类算法的比较。For unknown intrusion detection it is completed mainly by anomaly detection. Traditional anomaly detection methods need a reference model with a profile of normal action, but getting the absolutely pure normal data is a difficult thing, In this paper, we introduce clustering technology that is a new method used in anomaly detection, and it is a no-supervised anomaly detection method. We analysis the feasibility of clustering used in intrusion detection and provide a standardization process. Additionally, covering clustering algorithm is compared with two classic clustering algorithms.

关 键 词：入侵检测 异常检测 聚类 覆盖聚类算法 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]