基于密度和最优聚类数的入侵检测方法

邹臣嵩<sup>1</sup>,杨宇<sup>2</sup>

doi:10.13718/j.cnki.xsxb.2018.12.016

西南师范大学学报(自然科学版)

留言板

尊敬的读者、作者、审稿人, 关于本刊的投稿、审稿、编辑和出版的任何问题, 您可以本页添加留言。我们将尽快给您答复。谢谢您的支持!

姓名
	姓名不能为空！
邮箱
	邮箱不能为空！非法的邮箱地址。
手机号码
	电话不能为空！请输入有效手机号!
标题
	标题不能为空！
留言内容
	内容不能为空！
验证码
	验证码不能为空！验证码错误！

基于密度和最优聚类数的入侵检测方法

邹臣嵩1,杨宇2. 基于密度和最优聚类数的入侵检测方法[J]. 西南师范大学学报(自然科学版), 2018, 43(12): 91-99. doi: 10.13718/j.cnki.xsxb.2018.12.016

引用本文:

邹臣嵩¹,杨宇². 基于密度和最优聚类数的入侵检测方法[J]. 西南师范大学学报(自然科学版), 2018, 43(12): 91-99. doi: 10.13718/j.cnki.xsxb.2018.12.016

ZOU Chen-song1, YANG Yu2. Intrusion Detection Method Based on Density and Optimal Clustering Number[J]. Journal of Southwest China Normal University(Natural Science Edition), 2018, 43(12): 91-99. doi: 10.13718/j.cnki.xsxb.2018.12.016

Citation:

ZOU Chen-song¹, YANG Yu². Intrusion Detection Method Based on Density and Optimal Clustering Number[J]. Journal of Southwest China Normal University(Natural Science Edition), 2018, 43(12): 91-99. doi: 10.13718/j.cnki.xsxb.2018.12.016

基于密度和最优聚类数的入侵检测方法

邹臣嵩¹,杨宇²

1. 电气工程系;
2. 机械工程系, 广东韶关 512126

Intrusion Detection Method Based on Density and Optimal Clustering Number

ZOU Chen-song¹, YANG Yu²

1. Department of Electrical Engineering;
2. Department of Mechanical Engineering, Guangdong Songshan Polytechnic College, Shaoguan Guangdong 512126, China

摘要: 针对聚类算法在入侵检测应用中存在的参数预设、聚类有效性评价、未知攻击类型检测等问题，提出了一种基于密度和最优聚类数的改进算法，根据样本的分布情况启发式地确定初始聚类中心，从样本的几何结构角度提出一种新的内部评价指标，给出了最优聚类数确定方法，在此基础上，设计了一个增量式的入侵检测模型，实现了聚类中心和聚类数目的动态调整.实验结果表明，与K-means及其他两种改进聚类算法相比，新算法收敛速度更快、聚类准确率更高，能够对未知网络行为进行有效聚类，具有较好的入侵检测效果.
- 聚类算法 /
- 最优聚类数 /
- 入侵检测 /
- 有效性评价 /
- 密度聚类
Abstract: According to the problems of clustering algorithm in the application of intrusion detection, such as parameter presupposition, clustering effectiveness evaluation and unknown attack type detection, an improved algorithm based on density and optimal clustering number has been proposed. And according to the distribution of the samples, the initial clustering center has been determined heuristically, a new internal evaluation index has been proposed from the point of view of the geometric structure of the samples, and the optimal clustering number has been determined. On this basis, an incremental intrusion detection model has been designed to realize the dynamic adjustment of the clustering center and the number of clusters. Experimental results show that compared with K-means and other two improved clustering algorithms, the new algorithm has faster convergence speed and higher clustering accuracy, and can effectively cluster unknown network behaviors, and has better intrusion detection effect.
- clustering algorithm /
- optimal clustering number /
- intrusion detection /
- effectiveness evaluation /
- density clustering .

[1]	文华, 王斐玉. 利用SSO加速最佳路径森林聚类的网络入侵检测[J]. 西南师范大学学报(自然科学版), 2017, 42(5):34-40.
[2]	MACQUEEN J. Some Methods for Classification and Analysis of Mulitivariate Observations[C]//Proceedings of the 5th Berkeley Symposium on Mathematical Statistics and Probability. Berkeley:University of California Press, 1967:281-297.
[3]	PARK H S, JUN C H. A Simple and Fast Algorithm for K-medoids Clustering[J]. Expert Systems with Applications, 2009, 36(2):3336-3341.
[4]	LIU Y, HOU T, LIU F. Improving Fuzzy c-Means Method for Unbalanced Dataset[J]. Electronics Letters, 2015, 51(23):1880-1882.
[5]	孟静, 吴锡生. 自动确定聚类数算法在网络入侵检测中的应用[J]. 计算机仿真, 2013, 30(10):302-307.
[6]	BREUNIG M M, KREGEL H P, NG R T, et al. LOF:Identifying Densitybased Local Outliers[J]. ACM Sigmod Record, 2000, 29(2):93-104.
[7]	蒋盛益, 徐雨明, 陈溪辉. 异常挖掘研究综述[J]. 衡阳师范学院学报(自然科学), 2004(3):63-66.
[8]	翟东海, 鱼江, 高飞, 等. 最大距离法选取初始簇中心的K-means文本聚类算法的研究[J]. 计算机应用研究, 2014, 31(3):713-715,719.
[9]	熊忠阳, 陈若田, 张玉芳. 一种有效的聚类中心初始化方法[J]. 计算机应用研究, 2011, 28(11):4188-4190.
[10]	唐丹, 张正军. 近邻传播聚类算法的优化[J]. 计算机应用, 2017, 37(s1):258-261.
[11]	倪志伟, 荆婷婷, 倪丽萍. 一种近邻传播的层次优化算法[J]. 计算机科学, 2015, 42(3):195-200.
[12]	周世兵. 聚类分析中的最佳聚类数确定方法研究及应用[D]. 无锡:江南大学, 2011.
[13]	冯柳伟, 常冬霞, 邓勇, 等. 最近最远得分的聚类性能评价指标[J]. 智能系统学报, 2017, 12(1):67-74.
[14]	谢娟英, 周颖. 一种新聚类评价指标[J]. 陕西师范大学学报(自然科学版), 2015, 43(6):1-8.
[15]	KAPP A V, TIBSHIRANI R. Are Clusters Found in One Dataset Present in Another Dataset?[J]. Biostatistics, 2007, 8(1):9-31.
[16]	DAVIES D L, BOULDIN D W. A Cluster Separation Measure[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 1979, 2(2):224-227.
[17]	ROUSSEEUW P J. Silhouettes:a Graphical Aid to the Interpretation and Validation of Cluster Analysis[J]. Journal of Computational and Applied Mathematics, 1987, 20(20):53-65.
[18]	XIE X L, BENI G. A Validity Measure for Fuzzy Clustering[J]. IEEE Transactions on Pattern Analysisand Machine Intelligence, 1991, 13(8):841-847.
[19]	KWON S H. Cluster Validity Index for Fuzzy Clustering[J]. Electronics Letters, 1999, 34(22):2176-2177.
[20]	任敏. 自适应模糊聚类算法及其在入侵检测中的应用研究[D]. 济南:山东师范大学, 2017.
[21]	王开军, 张军英, 李丹, 等. 自适应仿射传播聚类[J]. 自动化学报, 2007(12):1242-1246.
[22]	解男男. 机器学习方法在入侵检测中的应用研究[D]. 吉林:吉林大学, 2015.
[23]	吴建胜, 张文鹏, 马垣. 数据集的数据分析研究[J]. 计算机应用与软件, 2014, 31(11):321-325.
[24]	李响. 基于经验模态分解的局域网络入侵检测算法[J]. 西南师范大学学报(自然科学版), 2016, 41(8):132-137.

计量

文章访问数: 585
HTML全文浏览数: 452
PDF下载数: 138
施引文献: 0

基于密度和最优聚类数的入侵检测方法

邹臣嵩¹,杨宇²

1. 电气工程系;
2. 机械工程系, 广东韶关 512126

收稿日期: 2018-05-15

关键词:

摘要: 针对聚类算法在入侵检测应用中存在的参数预设、聚类有效性评价、未知攻击类型检测等问题，提出了一种基于密度和最优聚类数的改进算法，根据样本的分布情况启发式地确定初始聚类中心，从样本的几何结构角度提出一种新的内部评价指标，给出了最优聚类数确定方法，在此基础上，设计了一个增量式的入侵检测模型，实现了聚类中心和聚类数目的动态调整.实验结果表明，与K-means及其他两种改进聚类算法相比，新算法收敛速度更快、聚类准确率更高，能够对未知网络行为进行有效聚类，具有较好的入侵检测效果.

English Abstract

Intrusion Detection Method Based on Density and Optimal Clustering Number

1. 电气工程系;
2. 机械工程系, 广东韶关 512126

Received Date: 2018-05-15

Keywords:

Abstract: According to the problems of clustering algorithm in the application of intrusion detection, such as parameter presupposition, clustering effectiveness evaluation and unknown attack type detection, an improved algorithm based on density and optimal clustering number has been proposed. And according to the distribution of the samples, the initial clustering center has been determined heuristically, a new internal evaluation index has been proposed from the point of view of the geometric structure of the samples, and the optimal clustering number has been determined. On this basis, an incremental intrusion detection model has been designed to realize the dynamic adjustment of the clustering center and the number of clusters. Experimental results show that compared with K-means and other two improved clustering algorithms, the new algorithm has faster convergence speed and higher clustering accuracy, and can effectively cluster unknown network behaviors, and has better intrusion detection effect.