基于混沌粒子群的IDS告警聚类算法  

IDS alert clustering algorithm based on chaotic particle swarm optimization

作　　者：胥小波[1,2] 蒋琴琴[2] 郑康锋[2] 武斌[2] 杨义先[2] 

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041 [2]北京邮电大学信息安全中心,北京100876

出　　处：《通信学报》2013年第3期105-110,共6页Journal on Communications

基　　金：中央高校基本科研业务费专项基金资助项目(BUPT2009RC0218);总装基金资助项目(9140A15060109DZ082);教育部科学技术研究重点基金资助项目~~

摘　　要：为了提高入侵检测系统(IDS)的告警质量,减少冗余报警,提出了一种基于混沌粒子群优化的IDS告警聚类算法。算法将混沌融入到粒子运动过程中,使粒子群在混沌与稳定之间交替运动,逐步向最优点靠近。该算法能够克服粒子群算法的早熟、局部最优等缺点,指导聚类中心寻找到全局最优解。通过理论分析与实验测试,验证了该算法在入侵检测系统中,能够大量减少告警数量,提高告警质量,具有较高的检测率和较低的误报率。In order to improve the quality of alerts in intrusion detection system （IDS） and reduce the large number of redundant alarms, an IDS alerts clustering algorithm based on chaotic particle swarm optimization was proposed. It made the motion of particles with characteristics of chaos, so as to make particles move between the state of chaos and stable, and gradually close to the optimal value. The CPSO algorithm could overcome the problem of premature and local opti mization, and take the center of cluster to find the global optimal solution. The analysis and experiment show that the al goriflam can significantly reduce the number of alerts and improve its quality, and has a high detection rate and low false detection rate.

关 键 词：入侵检测系统 告警聚类 混沌 粒子群优化 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]