DoS/DDoS数据两阶段聚类算法

Two-phase Clustering Algorithm for DoS/DDoS Data

提出了一种无监督的两阶段聚类算法TPC(Two-Phase Clustering Algorithm)用于识别DoS(denial of service)/DDoS(distributed denial of service)攻击流数据,算法第一阶段根据样本的距离相似性计算密度区域和稀疏区域,利用密度连接的概念对样本集进行初步聚合,第二阶段利用聚类内部的散布程度和样本平均距离来表示计算聚类之间的相似性,对性质相似的聚类进一步递归聚合.算法不仅够识别不规则形状的聚类,还能识别对不同密度的聚类,解决了密度聚类算法需要设置合适的全局参数的弊端.

An unsupervised two-phase clustering algorithm （TPC） is tributed denial of service） data traffic in this paper. In the first phase proposed to identify DoS/DDoS （denial of service/ disthe algorithm finds the dense regions and the sparse regions using the cases distance similarity, then initially agglomerates the cases based on density connected notion. In the second phase the algorithm computers the clusters similarity making use of the cluster distributed degree and the average distance then processes the recursive agglomerations between the close clusters. The algorithm is significantly effective not only in discovering arbitrary shape clusters,but also in identification different density clusters. Furthermore,the algorithm overcomes the density-based clustering algorithm＇s drawback, the requirement of the global appropriate input parameters.