基于聚类算法与序列异常技术的入侵检测新方法  

A new method for Intrusion Detection based on clustering and sequential exception technique

作　　者：刘绍海[1,2] 刘青昆[1] 安娜[1] 顾跃举 

机构地区：[1]辽宁师范大学计算机与信息技术学院,辽宁大连116029 [2]武警沈阳指挥学院教研部,辽宁沈阳110113 [3]武警辽宁总队,辽宁沈阳110033

出　　处：《计算机安全》2008年第8期1-4,共4页Network & Computer Security

基　　金：辽宁省博士科研启动基金(编号:20051058);大连市优秀青年科技人才基金(编号:2005J22JH031);辽宁省教育厅科研项目(编号:20060479)

摘　　要：入侵检测系统是当前网络与信息安全防护体系的重要组成部分,该文通过对数据挖掘技术在入侵检测系统中的应用进行归纳,提出了一种基于聚类与序列异常技术相结合的入侵检测算法。首先对入侵检测所用到的数据流进行标准化预处理;其次对初始化后的数据用改进的K-means算法进行聚类;最后应用序列异常技术对聚类结果的每个簇进行标记。研究表明,这种将聚类与序列异常技术相结合的算法可以有效地提高系统性能和检测的准确率。Intrusion Detection is a important compositive segment in network and information security recovery system today. This paper presents a new intrusion detection method which takes the advantages of clustering and sequential exception technique by the application of the data-mining technology in Intrusion Detection System. First the standardization pretreatment of the data flow should be used in Intrusion Detection.Secondly, the initialized data used the improved K-means clustering algorithm.At last, the application of sequential exception technique can mark every cluster which is the result of clustering.The research shows that the new method for Intrusion Detection which based on the combination of the clustering and sequential exception technique can effectively improve system performa, nce a nd enha, nce the accuracy of detection.

关 键 词：入侵检测 K-MEANS算法 序列异常技术 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP311.13[自动化与计算机技术—计算机科学与技术]