基于聚类合并的局部离群点挖掘算法在入侵检测中的应用  

Application of Local Outlier Mining Based on Cluster Merging Algorithm in Intrusion Detection

作　　者：梅孝辉 龙渊[1] 张健博[1] 

机构地区：[1]重庆大学计算机学院,重庆400044

出　　处：《计算机与现代化》2015年第8期67-70,共4页Computer and Modernization

基　　金：国家科技支撑计划重点项目(2011BAH25B04);国家自然科学基金资助项目(61272194)

摘　　要：针对网络安全数据的高维度特征问题,传统的基于聚类的检测算法不能有效发现网络数据中入侵行为细节。本文提出一种改进的DBSCAN离群点挖掘算法LDBSCAN-CM,首先在传统DBSCAN算法中引入局部离群点挖掘概念,计算候选对象的局部离群因子,生成若干个聚类;其次,为了提高挖掘效率,在聚类结果的基础上,进行聚类合并;最后,采用KDD Cup99数据集对改进算法在入侵检测中的应用进行仿真实验。实验结果表明,改进算法LDBSCAN-CM能保证较高的检测率和较低的误检率。According to the problem of high dimension of network security data, the traditional outliers based on cluster cannot effectively detect network intrusion behavior data in detail. This paper put forward an improved DBSCAN algorithm of outlier mining called LDBSCAN-CM. First, this paper introduced a concept of local outlier mining for traditional DBSCAN algorithm, calculated local outlier factors of candidate objects, and generated a number of clusters. Next, this paper merged clusters in order to improve the mining efficiency. Eventually, the KDD Cup99 dataset was applied to conduct simulation experiment on the application of the improved algorithm in intrusion detection. The results indicate that the improved algorithm LDBSCAN-CM can guarantee higher detection rate and lower false alarm rate.

关 键 词：入侵检测 数据挖掘 LDBSCAN—CM 局部离群点挖掘 聚类合并 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]