基于半监督聚类的入侵检测系统模型研究  

An Effective Intrusion Detection Model Using Semi-Supervised Clustering Algorithm

作　　者：邓磊[1] 高德远[1] 

机构地区：[1]西北工业大学计算机学院,陕西西安710072

出　　处：《西北工业大学学报》2010年第4期597-601,共5页Journal of Northwestern Polytechnical University

基　　金：教育部博士点新教师基金(20070699011)资助

摘　　要：在入侵检测系统中,未知标签数据容易获得,标签数据较难获得。文中提出了一个基于半监督聚类的入侵检测模型,利用少量的标签数据和大量未知标签数据生成self/nonself行为库,进而得到self/nonself模式库。实验结果表明,该模型有较高的检测率。Aim.The introduction of the full paper points out that what is discussed in Refs.1 and 2,is,in our opinion,not effective;thus we propose what we believe to be an effective intrusion detection model.Sections 1 and 2 brief the intrusion detection system and the semi-supervised clustering algorithm respectively.Section 3 discusses our intrusion detection model,whose structure is shown in Fig.2;its core consists of：（1） we obtain the self-behavior sets and non-self-behavior sets by using the semi-supervised clustering algorithm and then extract self pattern sets and non-self pattern sets from the above-mentioned two behavior sets;（2） we present the procedural steps of the pairwise constrained K means（PCKMeans） algorithm proposed by Sugato Basu et al in Ref.6.Section 4 simulates the intrusion detection model with the KDD Cup99 data sets;the simulation results,presented in Table 1,show preliminarily that our intrusion detection model is effective and that the detection rate of the PCKMeans algorithm is high.

关 键 词：入侵检测 半监督聚类 模型 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]