网络延迟聚类的宏观预警的检测点放置

大规模异常事件爆发,使网络可用性受到严重威胁。引发人们对大规模入侵检测系统的研究,其检测效果直接取决于网络检测点选取。大规模网络预警检测点放置问题被转化为网络拓扑有权图聚类问题。针对层次聚类算法面临的初始点选择问题提出基于出度分离初始点选择算法,降低聚类结果对初值的依赖。同时,提出改进双向层次聚类算法DHC,有效降低了结果簇数量。实验证明,此算法整体最优并成功应用于测得的真实全国骨干网络,有效解决了检测点放置问题。

Network latency clustering for detector placement on macroscopical prewarning

Research on the network-based and distributed intrusion detection was aroused by the burst-outs of large-scale security events.How to place detection instruments was the key to the detections.The problem of detector placement was turned to that of the clustering of topology graph.A novel bidirectional hierarchical clustering algorithm was put forward,which decreased the amount of result clusters by integration of initial marker selection method based on node out-degree.The simulation results demonstrates that our clustering approaches effectively identify clusters and been employed in the measured real network of the backbone.