改进的聚类算法在网络异常行为检测中的应用  

Application of Improved Clustering Algorithm in Network Abnormal Behavior Detection

作　　者：辛壮 万良[1] 李均涛[2] XIN Zhuang;WAN Liang;LI Jun-tao(School of Computer Science and Technology,Guizhou University,Guiyang 550025,China;School of Information,Guizhou University of Finance and Economics,Guiyang 550025,China)

机构地区：[1]贵州大学计算机科学与技术学院,贵州贵阳550025 [2]贵州财经大学信息学院,贵州贵阳550025

出　　处：《计算机技术与发展》2019年第3期111-116,共6页Computer Technology and Development

基　　金：贵州省研究生卓越人才计划项目(黔教研合ZYRCZ字[2014]010号);贵州省科学基金(黔科合J字[2011](2328);黔科合LH字[2014](7634))

摘　　要：网络异常行为检测是对大规模网络数据流量进行分析并发现入侵行为的一种方法。针对基于聚类的网络异常行为检测方法不能及时准确地选择初始聚类中心、无法有效地识别非球状簇等问题,提出一种改进的聚类算法应用在网络异常行为检测中。该方法使用最小生成树算法获得初始聚类中心,使用改进的K-means聚类算法区分异常行为与正常行为,通过距离比值判断聚类效果,提高了聚类效果的准确性。通过应用有监督学习的方式对聚类结果进行检测,结果表明,改进的聚类算法能够更好地识别初始聚类中心,并进行更加有效的聚类,能够更加准确地检测出网络异常行为。Network abnormal behavior detection is a method to analyze and discover the intrusion behavior of large-scale network data flow. The anomalous behavior detection method based on clustering cannot timely and correctly select the initial clustering center,and is unable to effectively identify the globular clusters.In order to solve these problems,we propose an improved clustering algorithm in the network abnormal behavior detection.This method obtains the initial clustering center by using the minimum spanning tree algorithm, distinguishing the abnormal behavior from the normal behavior by the improved K-means clustering algorithm and judging the clustering effect by the distance ratio,which improves the accuracy of the clustering effect.The results tested by supervised learning show that the improved clustering algorithm can better identify the initial clustering center and make more effective clustering,and detect the network anomaly behavior more accurately.

关 键 词：K-MEANS 最小生成树 网络异常行为 聚类 数据挖掘 

分 类 号：TP39[自动化与计算机技术—计算机应用技术]