基于半监督聚类的免疫入侵检测算法研究  

RESEARCH ON SEMI-SUPERVISED CLUSTERING-BASED IMMUNE INTRUSION DETECTION ALGORITHM

作　　者：王小伟[1] 王素芳[2] 

机构地区：[1]郑州大学体育学院现代教育技术中心,河南郑州450044 [2]焦作师范高等专科学校计算机与信息工程学院,河南焦作454000

出　　处：《计算机应用与软件》2013年第2期177-179,207,共4页Computer Applications and Software

基　　金：河南省自然科学基金项目(12B520056);郑州大学体育学院青年基金项目(2011C3003)

摘　　要：传统的基于免疫的入侵检测系统需要足够的标记数据才能够生成具有良好泛化性能的抗体,而网络环境中获得充足的标记数据是困难的。为克服这一难题,对无监督聚类技术及免疫方法进行深入研究,并将二者结合起来,提出一种半监督的免疫入侵检测算法SCIID(Semi-supervised cluster based Immune Intrusion Detection)。在抗体产生阶段通过对自我样本进行聚类,大大缩短了阴性选择的时间;在入侵检测阶段采用聚类技术可快速获取未标记数据的类别,进而指导后续的学习过程,达到提高检测率的目的。仿真结果表明,该算法在仅有少量标记数据的情况下,可以获得大部分未标记数据的类别,而且能发现新的攻击类型,同等训练样例数目条件下检测率高于单纯基于免疫的方法。In order to overcome the poser that traditional immunity-based intrusion detection system usually need enough labelled data to produce antibodies that have good generalisation performance,yet it is difficult to obtain sufficient labelled data in network environment,we make in-depth study on unsupervised clustering technology and the immunity method and combine them together,then propose an immune intrusion detection algorithm based on semi-supervised clustering technology,namely SCIID（Semi-supervised cluster based Immune Intrusion Detection）,in this paper.During the stage of antibodies generation the time of negative selection can be greatly shortened through clustering the self-samples,and during the stage of intrusion detection it the categories of unlabeled data can be rapidly obtained with clustering technique,and then they are used to guide the subsequent learning process so as to enhance the detection rate.Simulation results show that the proposed algorithm can obtain the types of majority unlabeled data,and can discover new attack types in circumstance of only having a little number of the labelled data,moreover,the detection rate of SCIID is higher than that of pure immunity-based method with same number of training datasets.

关 键 词：半监督 聚类 人工免疫 入侵检测 检测子 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]