融合K-均值聚类、FNN、SVM的网络入侵检测模型  

NETWORK INTRUSION DETECTION MODEL FUSING K-MEANS,FNN AND SVM

作　　者：邬斌亮 熊琭[1] 

机构地区：[1]上海市计算机软件评测重点实验室,上海201112

出　　处：《计算机应用与软件》2014年第5期312-315,共4页Computer Applications and Software

摘　　要：针对传统的入侵检测模型IDM(Intrusion Detection System)不能检测最新的入侵手段且系统的特征数据库需要频繁更新的问题,提出融合K-均值聚类、模糊神经网络和支持向量机等数据挖掘技术来构建IDM。首先,利用K-均值聚类将原始的训练集划分为不同的训练子集;然后,基于各训练子集训练各自的模糊神经网络模型,并通过模糊神经网络模型生成支持向量机的支持向量;最后,采用径向支持向量机检测入侵行为是否发生。在KDD CUP 1999数据集上的实验验证了所提模型的有效性及可靠性。实验结果表明,相比其他几种较为先进的检测方法,所提模型在入侵检测方面取得了更高的检测精度。For the issues that traditional intrusion detection model（ IDM） can not detect latest intrusion means and requires frequent update of its feature database,we propose to build IDM by fusing the data mining technologies of k-means clustering,fuzzy neural networks and support vector machine. First,the original training set is divided into different training subsets using k-means clustering. Then,each training subset trains its own fuzzy neural network model respectively based on itself and generates support vector of SVM through fuzzy neural network model. Finally,radial SVM is adopted to detect whether the intrusion action occurs. The effectiveness and reliability of the proposed model has been verified by experiments on KDD CUP 1999 dataset. Experimental results show that the proposed model achieves higher accuracy in intrusion detection comparing with some other advanced detection approaches.

关 键 词：入侵检测模型 K-均值聚类 模糊神经网络 支持向量机 数据挖掘 

分 类 号：TP399[自动化与计算机技术—计算机应用技术]