一种改进的半监督聚类入侵检测算法  

An Improved Intrusion Detection Algorithm Based on Semi-supervised Clustering

作　　者：胡翰[1] 李永忠[1] 

机构地区：[1]江苏科技大学计算机学院,江苏镇江212003

出　　处：《计算机仿真》2010年第3期140-142,150,共4页Computer Simulation

基　　金：江苏省教育厅江苏科技大学资助课题(2005DX006J)

摘　　要：针对网络环境,提出了一种新的半监督聚类入侵检测算法,将主动学习策略应用于半监督聚类过程中,利用少量的标记数据,生成用于初始化算法的种子聚类,通过辅助聚类过程,根据网络数据的特点,检测已知和未知攻击。主动学习策略查询网络中未标记数据与标记数据的约束关系,对标记数据可以快速获得k个不相交的非空近邻集,经检测结果证明,改进了算法的性能,且表明了算法的可行性及有效性。This paper proposes a novel for intrusion detection based on semi - supervised clustering and applies active learning strategy to semi - supervised clustering process. The algorithm uses a few limited labeled data to generate seed clusters initiating the algorithm and then aids clustering process. According to the characteristics of the net- work data, known and unknown attacks are detected. Active learning strategy searches the restriction relation between unlabeled data and labeled data in network, labeled data can rapidly attain k - disjointed - sets which are not null adjacent sets, and also improve performance of the algorithm. The experiment results manifest the feasibility and validity of the algorithm.

关 键 词：主动学习 半监督聚类 入侵检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]