利用SSO加速最佳路径森林聚类的网络入侵检测  

On a Speed up Optimum-Path Forest Clustering Algorithm Using SSO for Network IDS

作　　者：文华[1] 王斐玉[1] 

机构地区：[1]新疆交通职业技术学院,乌鲁木齐831401

出　　处：《西南师范大学学报（自然科学版）》2017年第5期34-40,共7页Journal of Southwest China Normal University(Natural Science Edition)

摘　　要：针对网络入侵检测系统中的一般聚类算法速度较慢和精度较低的问题,提出了一种基于简化群优化的最优路径森林聚类算法(SSO-OFC).首先,将数据集解析为图,将其节点作为样本;然后,将每个样本连接到其给定特征空间中的k-近邻,图的节点由它们的概率密度函数(pdf)值加权得到;最后,通过样本及k-近邻之间的距离计算得到pdf值.提出的算法主要贡献是快速估计最佳k值,并将最优路径森林聚类应用于网络入侵检测.在5个公开的数据集上进行实验.结果表明,SSO-OFC的精度非常稳定,除了KddCup数据集,其他数据集上的精度都在95%以上,相比基于数据聚类的SSO和自组织映射更加稳定有效.Concerning that the general clustering algorithms in network intrusion detection systems is slow and the accuracy rate is low,an optimum-path forest clustering algorithm(OFC)using simplified swarm optimization(SSO)has been proposed.Firstly,OFC analyzes data sets in figures,with the graphic nodes being as the samples.Then,every sample is connected to its feature space given k-nearest neighbor(KNN chart).The graph nodes are weighted by their probability density function(pdf).Finally,the pdf values are obtained by calculating the distance between the sample and the k-nearest neighbor.The main contribution of the proposed algorithm is to estimate the optimal k value fast,and the SSO-OFC is used in network intrusion detection.The experimental results on five public data sets show that the accuracy performance on five databases is very stable.Except on KddCup,the accuracy on other data sets are all above95%,much more stable than clustering based on SSO and self-organizing map.

关 键 词：网络入侵检测 最优路径森林聚类 简化群优化 概率密度函数 最佳k值 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]