改进K-means算法在入侵检测中的应用研究  

Application research of improved K-means algorithm in intrusion detection

作　　者：王茜[1] 刘胜会[1] 

机构地区：[1]重庆大学计算机学院,重庆400044

出　　处：《计算机工程与应用》2015年第17期124-127,144,共5页Computer Engineering and Applications

基　　金：科技部国家科技支撑计划重点项目(No.2011BAH25B04)

摘　　要：为了弥补传统K-means聚类算法在K值确定和初始中心选择难等方面的不足,基于"合并与分裂"思想,提出一种改进的K-means聚类算法。将数据独立程度概念引入实验数据子集构造理论中,利用独立程度评价属性的重要性;根据点密度将数据集合并为若干类,结合最小支撑树聚类算法与传统K-means聚类算法实现分裂;使用KDD Cup99数据集对改进算法在入侵检测中的应用进行仿真实验。结果表明,改进算法在检测率和误报率方面均优于传统K-means算法。An improved K-means clustering algorithm is put forward on basis of the split-merge method for the purpose of remedying defects both in determination of value in K and in selection of initial cluster centre of traditional K-means clustering. The concept of independence degree of date is incorporated into the experimental date subset construction theory,using independence degree to evaluate the importance of nature. The database is merged into several classes in respect of density of date points, the combination of the minimum spanning tree algorithm and traditional K-means clustering algorithm is conducive to the achievement of splitting. The KDD Cup99 database is applied to conduct simulation experiment on the application of the improved algorithm in intrusion detection. The results indicate that the improved algorithm prevails over traditional K-means algorithm in detection rate and false alarm rate.

关 键 词：入侵检测 数据挖掘 聚类算法 K-MEANS聚类 最小支撑树 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]