基于多重聚类的网络攻击检测方法研究  

Research on Network Attack Detection Approach Based on Multi-clustering

作　　者：杨宏宇[1] 张树茂[1] 江华[1] 

机构地区：[1]中国民航大学计算机科学与技术学院,天津300300

出　　处：《微电子学与计算机》2015年第8期24-29,34,共7页Microelectronics & Computer

基　　金：国家科技重大专项(2012ZX03002002);国家自然科学基金(60776807;61179045);国家"八六三"计划重点课题(2006AA12A106);天津市科技计划重点项目(09JCZDJC16800);中国民航科技基金(MHRD201009;MHRD201205)

摘　　要：提出一种基于多重聚类的网络攻击检测模型(Multi-clustering based network attack detection model,MBNADM).首先,采用改进空间聚类算法(Improved spatial clustering,ISC)进行空间聚类;其次,采用改进密度聚类算法(Improved density based clustering,IDBC)对空间数据集进行细粒度的二次聚合分类并对k值进行设定;最后,采用改进证据累积聚类算法(Improved evidence accumulation clustering,IEAC)计算各个孤立点与类簇质心的相异距离值,运用矩阵聚类算法计算检测阈值并判定网络中的攻击行为.通过基于KDD99数据集的攻击检测实验和与不同方法的检测对比实验证明了MBNADM具有较高的检测率和较低的误报率.This paper presents a new multi-clustering based network attack detection model（MBNADM）.Firstly,the improved spatial clustering（ISC）algorithm was designed to clustering subspace.Secondly,the improved density based clustering（IDBC）algorithm was used to complete the fine-grained aggregation operation on the spatial data sets and the k value setting.Finally,the distinct distance values among each isolated point（network attack）and clustered centroid were calculated with the improved evidence accumulation clustering（IEAC）algorithm,then the matrix clustering algorithm was used to calculate the detection threshold and consequently the network attacks in network behaviors were determined.The attack detection experiments on KDD99 dataset and the detection comparison experiment of different detection methods demonstrate that the MBNADM method has a high detection rate and low false positive rate.

关 键 词：网络攻击 检测 聚类 证据累积 空间 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP393.08[自动化与计算机技术—计算机科学与技术]