半监督聚类在入侵检测中的应用研究

随着网络的快速发展,入侵检测系统生成的告警信息越来越多,聚类技术广泛的应用于处理告警信息.针对传统的K-Means算法易陷入局部最优,提出一种改进半监督聚类算法ISC.从数据集中抽取若干正常与异常样本分别采用层次聚类算法分别计算作为初始质心辅助K-Means算法进行聚类.实验结果表明,与现有相关算法相比,该算法具有更高的攻击检测率以及更低的误报率.

Application Research on Semi-Supervised Clustering in Intrusion Detection

With the rapid development of network, intrusion detection systems generate more and more alert information. Therefore, clustering technique is widely used in processing alerts. The traditional K-Means algorithm is easily trapped into local optimum, An im- proved semi-supervised clustering algorithm is proposed in this paper in order to overcome this problem. We collect samples which are labled normal and abnormal, then calculate them respectively with hierarchical clustering algorithm to support the initialization phase of K-Means clustering algorithm.Experimental results show that proposed clustering algorithm has a higher attack detection rate and lower false positive rate.