基于随机森林和加权K均值聚类的网络入侵检测系统  

Network Intrusion Detection System Based on Random Forests and K-means Clustering Algorithm

作　　者：任晓芳[1] 赵德群[1] 秦健勇[1] 

机构地区：[1]新疆工学院计算机工程系,乌鲁木齐830023

出　　处：《微型电脑应用》2016年第7期21-24,共4页Microcomputer Applications

基　　金：新疆维吾尔自治区自然科学基金项目(2013211A031);新疆工程学院人文基金项目(2014xgy311612)

摘　　要：目前,许多误用检测系统无法检测未知攻击,而异常检测系统虽然能够精确检测未知攻击,但具有较高的误报警率。为此,提出了一种基于随机森林和加权K均值聚类算法的混合入侵检测系统。首先,利用随机森林算法从训练集中建立入侵模型,构建误用检测模型,通过网络连接的特征匹配来检测已知攻击。然后,利用加权K均值算法构建异常检测模块,根据随机森林算法获得的特征,将不确定性攻击的网络连接数据进行聚类,进而实现未知攻击的检测。在KDD′99数据库中的实验表明,该系统具有较高的检测率和较低的误报警率。Currently,a lot of misuse detection system can＇t detect unknown attack,while the anomaly detection system can detect unknown attacks accurately,but has a high false alarm rate.A hybrid intrusion detection system based on random forest and weighted PC-means clustering algorithm is proposed.Firstly,it uses the random forest algorithm to set up the intrusion model from the training set,construct the misuse detection model,and detect the known attacks by the feature matching of the network connection.Then,the anomaly detection module is constructed by using the weighted K-means algorithm,and the network connection data of the non deterministic attacks are clustered according to the characteristics obtained by the random forest algorithm.Experiments on KDD＇99database show that the system has high detection rate and low false alarm rate.

关 键 词：入侵检测系统 随机森林 加权K-均值聚类 误用检测 异常检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]