基于划分和凝聚层次聚类的无监督异常检测  

Unsupervised Anomaly Detection Based on Partition and Agglomerative Hierarchical Clustering

作　　者：李娜[1] 钟诚[1] 

机构地区：[1]广西大学计算机与电子信息学院,南宁530004

出　　处：《计算机工程》2008年第2期120-123,126,共5页Computer Engineering

基　　金：广西自然科学基金资助项目(桂科自0339008);广西大学博士科研基金资助项目(B0309031)

摘　　要：将信息熵理论应用于入侵检测的聚类问题,给出在混合属性条件下数据之间距离、数据与簇之间距离、簇与簇之间距离的定义,以整体相似度的聚类质量评价标准作为聚类合并的策略,提出了一种基于划分和凝聚层次聚类的无监督的异常检测算法。算法分析和实验结果表明,该算法具有较好的检测性能并能有效检测出未知入侵行为。Information entropy theory is applied to the clustering problem for intrusion detection, and the distances for mixed attributes between two data items, data and clusters, and two clusters are defined. By applying overall similarity to evaluate the cluster quality for merging clusters, an unsupervised anomaly detection algorithm based on partition and agglomerative hierarchical clustering, is presented. The algorithm analysis and experimental results show that this algorithm obtains good detection performance and can detect efficiently the new unknown intrusions.

关 键 词：入侵检测 划分聚类 凝聚层次聚类 信息熵 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]