基于聚类分析的动态自适应入侵检测模式研究  

Research of dynamic self-adaption intrusion detection model based of clustering

作　　者：梁飞[1] 闫宏印[1] 

机构地区：[1]太原理工大学计算机与软件学院,山西太原030024

出　　处：《计算机工程与设计》2013年第3期814-820,共7页Computer Engineering and Design

基　　金：山西省自然科学基金项目(2010011025-2)

摘　　要：针对传统的基于聚类分析入侵检测的研究大都通过改进算法增强入侵检测的效果,算法往往具有较高的空间和时间复杂度,算法参数大多通过人工尝试得到,参数的最优化和动态改变无法得到保证的问题,提出一种新的入侵检测模式,采用针对K-means算法的特点的预处理过程,充分利用K-means算法应用的具体环境,将可得到入侵信息指导K-means算法的执行。加快了算法的收敛速度,解决了K-means算法本身存在的问题。通过动态确定初始中心向量和半径阈值参数建立了一种动态自适应入侵检测模式。通过实验验证了这种检测模式是有效的,能有效检测某一种具体的入侵类型。Traditional intrusion detection based of Clustering research mostly through improving algorithm to improve the ettect of intrusion detection, it is usually not efficient in time and memory. Algorithm parameters are decided by artificial attempts, it is difficult to ensure the parameters is the best and dynamic. The problems are solved by a new intrusion detection model, the preprocessing method adapt for the algorithm is used in the algorithm. The environment which K-means applied in is made good use of, useful information about intrusion is used in the execution of the algorithm, so it has a quick convergence speed, and the problems K-means itself has are solved. A dynamic intrusion detection model is established through setting up an reasonable dynamic method to confirm The begining center vectors and Radius threshold parameters. The intrusion detection model is useful verified by experiment, and it can be used to detect a special intrusion.

关 键 词：入侵检测 K-MEANS算法 聚类 自适应 动态检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]