一种基于正常简档聚类的自适应异常检测模型  

Adaptive anomaly detection model based on normal-profile clustering

作　　者：刘卫国[1] 李斌[1] 

机构地区：[1]中南大学信息科学与工程学院,长沙410083

出　　处：《计算机应用研究》2009年第11期4292-4294,共3页Application Research of Computers

基　　金：国家自然科学基金资助项目(60773013);湖南省自然科学基金资助项目(07JJ5078)

摘　　要：为解决入侵检测系统存在检测率低、网络数据变化适应性弱的问题,选取正常数据记录通过聚类算法建立正常简档,然后依据正常简档对网络数据记录进行检测,并结合已检测出来的正常数据记录对正常简档进行更新。KDDCUP99数据的实验表明,该系统能够适应数据的变化趋势,在保持较低的误报率前提下获得了较好的检测率。To resolve the problem that intrusion detection system had a low detection rate and a weak adaptation to network data changes, this paper selected normal data records to establish a normal profile through the clustering algorithm, and detected the network data records according to the normal profile, and then updated the normal profile with the normal data records detected. KDD CUP99 experimental data shows that the detection system is adapt to data change trends and has a better detection rate while maintaining a very low false alarm rate.

关 键 词：入侵检测 正常简档 聚类 自适应 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]