数据流聚类算法在入侵检测中的应用  

Application of data stream clustering algorithm in intrusion detection

作　　者：黄红艳[1] 安素芳[1] 

机构地区：[1]石家庄经济学院信息工程学院,石家庄050031

出　　处：《计算机工程与应用》2012年第20期112-116,共5页Computer Engineering and Applications

基　　金：河北省科技计划项目(No.10213559)

摘　　要：处理数据流的能力成为入侵检测系统面临的挑战,针对这一现状提出DC-stream算法,该算法采用在线离线两阶段聚类,设计了一套缓冲式异常点处理机制,在保证数据流聚类效率和精度的同时,能够过滤噪音数据。实验结果证明,该算法能在海量的网络数据流中及时有效地发现入侵行为,并具有较强的抗干扰能力。The capacity of dealing with data streams has become a challenge for intrusion detection system. A DC-stream algorithm is proposed in view of this situation. Adopting both online and offline clustering, the DC-stream algorithm designs a buffer type anomaly detection mechanism, which can not only ensure the efficiency and accuracy of the data stream clustering, but also filter the noise data. The experimental result shows that the algorithm can detect intrusion behaviors in the mass network data stream timely and effectively, and has strong antiinterference ability.

关 键 词：入侵检测 核心微簇 缓冲微簇 聚类纯度 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]