一种基于正常简档聚类的自适应异常检测模型

Adaptive anomaly detection model based on normal-profile clustering

为解决入侵检测系统存在检测率低、网络数据变化适应性弱的问题,选取正常数据记录通过聚类算法建立正常简档,然后依据正常简档对网络数据记录进行检测,并结合已检测出来的正常数据记录对正常简档进行更新。KDDCUP99数据的实验表明,该系统能够适应数据的变化趋势,在保持较低的误报率前提下获得了较好的检测率。

To resolve the problem that intrusion detection system had a low detection rate and a weak adaptation to network data changes, this paper selected normal data records to establish a normal profile through the clustering algorithm, and detected the network data records according to the normal profile, and then updated the normal profile with the normal data records detected. KDD CUP99 experimental data shows that the detection system is adapt to data change trends and has a better detection rate while maintaining a very low false alarm rate.