一种增强的基于GCA的入侵检测方法

增强的基于GCA（Gravity-based clustering approach）的入侵检测方法是先对训练集采用GCA进行聚类,然后依据凝聚层次聚类算法的思想,以簇间的差异度和整体相似度作为聚类质量评价标准对GCA聚类产生的簇进行一些合并,合并后能使簇中心更集中,簇内对象更紧密。再根据标记算法标记出哪些簇属于正常簇,哪些属于异常簇,最后用检测算法对测试集数据进行检测。实验表明该方法对未知攻击的检测能力有所增强,特别是能有效降低误报率。

An Enhanced Intrusion Detection Method based on GCA

The enhanced intrusion detection method based on GCA（Gravity-based clustering approach）is clustering the training set by GCA firstly.Then based on the idea that agglomerative hierarchical clustering algorithm to combine clusters that GCA clustering produced with the standard of clustering quality evaluation which the difference degree between clusters and the overall similarity.To enable the cluster center is more concentrated and the objects in cluster are more closely after the combination.Then under the marking algorithm to identify which clusters are normal cluster,which are abnormal clusters.Finally,using detection algorithm to detect the test set data.Experiments show that the capability of detecting unknown attacks have increased,particularly to reduce the false positive rate.