改进K-means算法在入侵检测中的应用研究

为了弥补传统K-means聚类算法在K值确定和初始中心选择难等方面的不足，基于“合并与分裂”思想，提出一种改进的K-means聚类算法。将数据独立程度概念引入实验数据子集构造理论中，利用独立程度评价属性的重要性；根据点密度将数据集合并为若干类，结合最小支撑树聚类算法与传统K-means聚类算法实现分裂;使用KDD Cup99数据集对改进算法在入侵检测中的应用进行仿真实验。结果表明，改进算法在检测率和误报率方面均优于传统K-means算法。

Application research of improved K-means algorithm in intrusion detection

An improved K-means clustering algorithm is put forward on basis of the split-merge method for the purpose of remedying defects both in determination of value in K and in selection of initial cluster centre of traditional K-means clustering. The concept of independence degree of date is incorporated into the experimental date subset construction theory, using independence degree to evaluate the importance of nature. The database is merged into several classes in respect of density of date points, the combination of the minimum spanning tree algorithm and traditional K-means clustering algorithm is conducive to the achievement of splitting. The KDD Cup99 database is applied to conduct simulation experiment on the application of the improved algorithm in intrusion detection. The results indicate that the improved algorithm prevails over traditional K-means algorithm in detection rate and false alarm rate.