半监督聚类在入侵检测中的应用研究  

Application Research on Semi-Supervised Clustering in Intrusion Detection

作　　者：周志平[1] 庄金莲[1] 陈佳丽[1] 

机构地区：[1]龙岩学院数学与计算机科学学院,福建龙岩364000

出　　处：《武夷学院学报》2013年第5期56-60,共5页Journal of Wuyi University

摘　　要：随着网络的快速发展,入侵检测系统生成的告警信息越来越多,聚类技术广泛的应用于处理告警信息。针对传统的K-Means算法易陷入局部最优,提出一种改进半监督聚类算法ISC。从数据集中抽取若干正常与异常样本分别采用层次聚类算法分别计算作为初始质心辅助K-Means算法进行聚类。实验结果表明,与现有相关算法相比,该算法具有更高的攻击检测率以及更低的误报率。With the rapid development of network, intrusion detection systems generate more and more alert information. Therefore, clustering technique is widely used in processing alerts. The traditional K-Means algorithm is easily trapped into local optimum, An im- proved semi-supervised clustering algorithm is proposed in this paper in order to overcome this problem. We collect samples which are labled normal and abnormal, then calculate them respectively with hierarchical clustering algorithm to support the initialization phase of K-Means clustering algorithm.Experimental results show that proposed clustering algorithm has a higher attack detection rate and lower false positive rate.

关 键 词：层次聚类 半监督聚类 入侵检测 告警融合 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]