基于商空间粒度聚类的异常入侵检测

Anomaly intrusion detection based on quotient space granularity clustering

针对异常入侵检测技术中传统聚类方法需要被检测类大小均衡的问题,在商空间粒度理论的基础上,论述了商空间粒度变换可以使复杂问题在不同的粒度世界求解,最终使整个问题得到简化。分析了商空间划分与聚类操作的相似性,提出了基于商空间的粒度聚类方法,并将该方法与入侵检测技术相结合,构建了基于商空间粒度聚类的入侵检测系统,用于对KDD CUP 1999数据集的异常入侵检测。实验结果表明,该入侵检测系统的性能明显优于基于传统聚类方法的入侵检测系统,从而证明了该方法的正确性和有效性。

In view of the problem which traditional clustering methods need equilibrium detection class,this paper discussesd that quotient space granularity transformation could make complex problem to be solved in different granularity world basing on quotient space granularity theory, and ultimately simplified the whole problem.Then analyzed the similarity of the quotient space division and the clustering operation and put forward the method of granularity clustering based on quotient space. Moreover,combining the method and intrusion detection technology, constructed the intrusion detection system on the basis of quotient space granularity clustering and used the system to realize anomaly detection on the KDD CUP 1999 data sets. Finally experimental results show that the intrusion detection system is superior to other systems which is based on the traditional clustering methods.All these prove the correctness and effectiveness of the method.