基于聚类算法与序列异常技术的入侵检测新方法

入侵检测系统是当前网络与信息安全防护体系的重要组成部分,该文通过对数据挖掘技术在入侵检测系统中的应用进行归纳,提出了一种基于聚类与序列异常技术相结合的入侵检测算法。首先对入侵检测所用到的数据流进行标准化预处理;其次对初始化后的数据用改进的K-means算法进行聚类;最后应用序列异常技术对聚类结果的每个簇进行标记。研究表明,这种将聚类与序列异常技术相结合的算法可以有效地提高系统性能和检测的准确率。

A new method for Intrusion Detection based on clustering and sequential exception technique

Intrusion Detection is a important compositive segment in network and information security recovery system today.This paper presents a new intrusion detection method which takes the advantages of clustering and sequential exception technique by the application of the data-mining technology in Intrusion Detection System. First the standardization pretreatment of the data flow should be used in Intrusion Detection.Secondly, the initialized data used the improved K-means clustering algorithm.At last, the application of sequential exception technique can mark every cluster which is the result of clustering.The research shows that the new method for Intrusion Detection which based on the combination of the clustering and sequential exception technique can effectively improve system performance and enhance the accuracy of detection.