基于无监督聚类的入侵检测方法

研究了基于无监督聚类的入侵检测算法.算法的基本思想是首先通过比较无类标训练集样本间的距离来生成聚类,并根据正常类比例N来确定异常数据类别,然后再用于真实数据的检测.该方法的优点在于不需要用人工的或其他的方法来对训练集进行分类.实验采用了KDD99的测试数据,结果表明,该方法能够比较有效的检测真实网络数据中的未知入侵行为.

An Unsupervised Clustering-Based Intrusion Detection Method

An unsupervised clustering-based intrusion detection algorithm is discussed.The basic idea of the algorithm is to produce the cluster by comparing the distances of unlabeled training data sets.With the classified data instances,anomaly data clusters can be easily identified by normal cluster ratio.And then the identified cluster can be used in real data detection.The benefit of the algorithm is that it needn't labeled training data sets.Using the data sets of KDD99,the experiment result shows that this approach can detect unknown intrusions efficiently in the real network connections.