聚类分析与模糊评判结合的入侵检测算法  

Intrusion detection algorithm based on fuzzy evaluation and clustering analysis

作　　者：翟光群[1] 王永生[1] 

机构地区：[1]郑州大学信息工程学院,郑州450001

出　　处：《计算机工程与应用》2012年第21期99-102,122,共5页Computer Engineering and Applications

基　　金：河南省重点科技攻关项目(No.0423020300)

摘　　要：针对K-prototypes聚类算法处理混合型入侵检测数据时易陷入局部最优且对初始值敏感的问题,提出了一种基于K-prototypes与模糊评判相结合的入侵检测方法,利用K-prototypes对数据进行统计归类,在聚类中建立模糊评判模型,从统计和特征两方面对数据进行双重判定。实验结果表明两种算法的有效结合,可以提高任一种算法单独使用时的检测性能,有效地提高了检测率,降低了误检率。To solve the problem that K-prototypes clustering algorithm is easy to fall into local optimal solution and strongly depends on its initial value in processing mixed attributes data.This paper puts forward a new intrusion detection algorithm based on the combination of K-prototypes and fuzzy evaluation.The method classifies the data by K-prototypes,and builds fuzzy evaluation models on each clustering in order to detect the data from statistics and characteristics.The result of experiment shows that the method not only improves the detection accuracy,but also reduces false detection rate compared to K-prototypes algorithm or fuzzy evaluation.

关 键 词：聚类算法 混合属性 模糊评判 入侵检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]