基于无监督聚类算法的入侵检测  

Intrusion Detection Based on Unsupervised Clustering Algorithm

作　　者：王飞[1] 钱玉文[1] 王执铨[1] 

机构地区：[1]南京理工大学自动化学院,江苏南京210094

出　　处：《南京理工大学学报》2009年第3期288-292,共5页Journal of Nanjing University of Science and Technology

基　　金：江苏省自然科学基金(BK2008403)

摘　　要：针对应用聚类方法检测入侵中参数人为指定的问题,提出了一种新的基于无监督的聚类算法。该方法不需要人为设置参数并且不受数据输入顺序的影响,聚类的形状是任意的,能够较真实地反映数据分布的具体性状。算法通过比较无类标训练集样本间的距离,根据距离最近的样本首先聚合成类的特性,在每一步聚类结束时,再次比较类间距离以及计算类内数据占总数据的比率来确定异常数据类。实验证明该算法处理未知入侵检测问题的检测率为89.5%,误报率为0.4%。An unsupervised clustering algorithm is proposed to solve the problem that most of intrusion detections based on clustering algorithm have artificial parameters. This method has no artificial parameter and is not affected by the order of data entrance. The shape of clusters is arbitrary, which can reflect the real distribution of data. By comparing the distances between unlabeled training data, the algorithm merges characters of clusters according to the characters of nearest samples. When each step of clustering is completed, the algorithm identifies the intrusion clusters by comparing the distances of clusters and calculating the rate of samples of each cluster among all samples. The identified clusters can be used in real data detection. The experimental result shows that the detection rate is 89.5% and the false alarm rate is 0.4% in detecting unknown intrusion.

关 键 词：入侵检测 计算机犯罪 探测器 因特网 网络安全 无监督聚类 无类标数据 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]