基于各向异性质心Voronoi图的网络异常检测技术

网络异常检测技术是入侵检测研究领域中的重要内容，但在检测率和误报率上存在相互制约的问题，导致实际应用中性能不高。基于各向异性质心Voronoi图，提出一种新的网络异常检测算法。在新算法中，首先对数据集用各向异性质心Voronoi图进行聚类，然后计算每个数据点的点密度，判断数据点是否正常。通过KDD Cup1999数据集的实验测试表明，新算法具有较高的检测率和较低的误报率。

Network anomaly detection based on anisotropic centroidal Voronoi diagram

Network anomaly detection is an important research topic in the field of intrusion detection. However, it is inefficient in practice because the detection rate and false alarm rate restrain each other. Based on the anisotropic centroidal Voronoi diagram, a new algorithm of network anomaly detection was proposed. In this new algorithm, the anisotropic centroidal Voronoi diagram was used in the clustering of data set at first, then the point density for each data point was computed out, which was used to determine whether the data point was normal or not. The laboratory tests on KDD Cup 1999 data sets show that the new algorithm has a higher detection rate and a lower false alarm rate.