一种改进的基于密度聚类的入侵检测算法

An Improved Intrusion Detection Algorithm Based On DBSCAN

密度聚类算法DBSCAN是一种有效的聚类分析方法。本文构建了网络入侵检测系统模型,并将一种改进的基于密度聚类的入侵检测算法IDBC应用于检测引擎设计。IDBC算法改进了网络连接记录的距离计算方式,并在DBSCAN聚类结果的基础上,进行聚类合并。实验结果表明,与DBSCA2N算法相比,IDBC显著降低了入侵检测的误报率,提高了入侵检测系统的性能。

DBSCAN is an efficient analysis method of clustering algorithm in data mining. In this paper, a model of intrusion detection system is built, and an IDBC algorithm is applied in the designing of detection engine. IDBC algorithm improves the computing of distance of network connecting records, and clusters merges based on the result of DBSCAN. Experiment resuhs prove that, comparing DBSCAN, IDBC reduces the false positive rates, and promote the performance of intrusion detection system.