改进的聚类算法在入侵检测系统中的应用  

Research on Improved Cluster Algorithm for Intrusion Detection System

作　　者：邢瑞康 李成海[1] XING Rui-kang;LI Cheng-hai(School of Air and Missile Defence,Air-force Engineering University,Xi’an 710051,China)

机构地区：[1]空军工程大学防空反导学院,西安710051

出　　处：《火力与指挥控制》2019年第2期124-128,共5页Fire Control & Command Control

基　　金：国家自然科学基金青年科学基金资助项目(61703426)

摘　　要：K-中心点聚类算法是几种经典的聚类算法之一。但传统的K-中心点聚类算法的效率以及稳定性较低,聚类的过程缓慢,容易陷入局部最优解,使得聚类最终结果的准确性不能得到保证。为此,提出了一种基于数据的"密度"信息有效地改进K-中心点聚类算法并应用于入侵检测模型。该算法很好地克服了传统的K-中心点聚类算法过分依赖初始中心点选择的弊端,并且用实验分别验证,以这种方法来进行数据的聚类相比于传统的K-中心点聚类算法,显著提高了数据集聚类的效果,在入侵检测系统的应用中也有效地提高了检测率和降低了误检率,具备一定的实用价值。Clustering technique has been extensive researched in intrusion detection.K-Medoids Data Cluster Algorithm is one of the most important methods that well-known to us all.K-Medoids Data Cluster Algorithm often gets trapped in local optimum and the computing cost is too high for large data sets.It makes that the clustering result accuracy cannot be guaranteed.So it proposes an improved K-medoids algorithm based on density information of data in order to solve the problem that the performance of original clustering algorithm is too dependent on the initial selection of centers and applied to Intrusion Detection System.Simulation results demonstrate that the excellent clustering efficiency is obtained by this parallel speeding K-medoids method and The experiments show that the detection rate is improved effectively and the false positive rate is reduced.The improved algorithm than the existing algorithm has certain advantages.

关 键 词：聚类算法 入侵检测 密度信息 K-中心点 

分 类 号：TP301.6[自动化与计算机技术—计算机系统结构]