一种基于动态聚类的异常入侵检测方法

运用数据挖掘方法进行入侵检测已经成为网络安全领域的一个重要研究方向。提出一种动态聚类的数据挖掘方法进行异常入侵检测，该方法将不同用户行为的特征动态聚集，根据各个子的类支持度与预设的检测阈值比较来区分正常与异常。由于动态聚类算法在每次聚类过程中都检验归类的合理性，因此获得很好的聚类效果。实时检测试验得到了较高的检测率和较低的误报率。

Approach of anomaly intrusion detection using dynamic clustering

Utilizing data mining techniques in intrusion detection system has become one of important directions in realm of network se-curity. An anomaly intrusion detection approach using dynamic clustering is proposed which can classify the users' activities into differentclusters automatically and identify the normal or abnormal connections by comparing the values of sub cluster and the preset threshold.The algorithm exhibits superior performance in that it checked validity of the clustering in each process. The results show that experimentson real-time intrusion detection achieve higher attack detection rate with lower false positive rate.