一种改进的半监督聚类入侵检测算法

An Improved Intrusion Detection Algorithm Based on Semi-supervised Clustering

针对网络环境,提出了一种新的半监督聚类入侵检测算法,将主动学习策略应用于半监督聚类过程中,利用少量的标记数据,生成用于初始化算法的种子聚类,通过辅助聚类过程,根据网络数据的特点,检测已知和未知攻击。主动学习策略查询网络中未标记数据与标记数据的约束关系,对标记数据可以快速获得k个不相交的非空近邻集,经检测结果证明,改进了算法的性能,且表明了算法的可行性及有效性。

This paper proposes a novel for intrusion detection based on semi - supervised clustering and applies active learning strategy to semi - supervised clustering process. The algorithm uses a few limited labeled data to generate seed clusters initiating the algorithm and then aids clustering process. According to the characteristics of the net- work data, known and unknown attacks are detected. Active learning strategy searches the restriction relation between unlabeled data and labeled data in network, labeled data can rapidly attain k - disjointed - sets which are not null adjacent sets, and also improve performance of the algorithm. The experiment results manifest the feasibility and validity of the algorithm.