一种基于聚类的无监督异常检测方法  

Clustering-based unsupervised anomaly detection method

作　　者：杨斌[1] 刘卫国[1] 

机构地区：[1]中南大学信息科学与工程学院,长沙410083

出　　处：《计算机工程与应用》2008年第1期138-141,共4页Computer Engineering and Applications

基　　金：湖南省教育厅资助科研课题(the Research Project of Department of Education of Hunan Province;China under Grant No.湘教通[2004]344号)。

摘　　要：为了解决无监督异常检测方法无法检测突发性的大规模攻击的问题,提出了一种基于聚类的无监督异常检测模型,该模型从多个聚类器中选取DB指数最小的分簇结果,并利用最小簇内距离、最大簇内距离对每个簇进行分类,从而识别出攻击。实验表明该模型明显提高了检测率、降低了误报率。Unsupervised anomaly detection can＇t detect a massive attack in bursts.In order to solve this problem,this paper proposes a unsupervised anomaly detection model based on clustering.It chooses clustering result from multi-clusters which has the minimum DB index,applies minimum intra-cluster distance and maximum intra-cluster distance to classify every cluster,then identifies attacks.Experimental results show that the proposed strategy can improve obviously detection rate and decrease false positive rate.

关 键 词：无监督异常检测 K均值算法 DB指数 簇内距离 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]