一种基于差异度聚类的异常入侵检测算法  

An Anomaly Intrusion Detection Algorithm Based on Difference Clustering

作　　者：王娟[1] 张科[1] 任达森[2] 周丽华[1] 

机构地区：[1]贵州民族学院计算机网络中心,贵阳550025 [2]贵州民族学院计算机与信息工程学院,贵阳550025

出　　处：《河南师范大学学报（自然科学版）》2010年第5期61-64,共4页Journal of Henan Normal University(Natural Science Edition)

基　　金：贵州省优秀科技教育人才省长专项资金项目(黔省专合字2008-42);贵州民族学院科研项目(校科研2009JS11)

摘　　要：基于差异度聚类分析,提出了一种新的异常入侵检测算法DCAIDA,详细介绍了基于差异度聚类分析的用户行为模型建立算法和异常入侵检测算法.通过对原始用户行为数据进行差异度聚类分析,建立用户行为模型,并依据聚类模型对实时的用户行为进行分类,以此判断是否发生入侵.在KDD CUP 1999上的仿真实验结果表明：该算法检测率高、误报率低,且对新攻击类型有一定的检测能力,可实现预期效果.Based on difference clustering analysis,this paper puts forward a new kind of anomaly intrusion detection algorithm DCAIDA.It introduces in detail user behavior model building algorithm and anomaly intrusion detection algorithm.Through making difference clustering analysis of original user behavior data,user behavior models can be built;According to clustering models to classify real-time user behavior,thereby whether it intrudes or not can be determined.The simulation experiment results based on KDD CUP 1999 show that： this algorithm has a high detection rate and a low false alarm rate,at the same time it has a certain capability to detect new types of attacks,so it can realize the desired results.

关 键 词：入侵检测 差异度 聚类 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]