基于密度的离群点挖掘在入侵检测中的应用

Application of Density-based Outlier Mining in Intrusion Detection

给出一种基于密度的局部离群点挖掘方法。采用KDD99数据集进行实验,对数据集中的41个属性提取特征,利用基于密度的聚类对统计处理过的数据集实行剪枝操作,剪除数据集中大部分密集的数据对象,保留未被剪除的候选离群对象集。采用局部离群挖掘方法计算离群候选对象的离群因子,检测出异常攻击。实验结果表明,该方法能保证较高的检测率和较低的误报率。

A method of density-based local outlier mining method is proposed.The method by use of the dataset of KDD99 experiment,executes feature extraction on 41 properties of the dataset.It exploits density-based clustering to program by pruning on the statistics of processed data sets,cuts off the most intensive data objects in the dataset and reserves the candidated outlier set of object which can not be cut off.It uses local outlier mining method to count the Local Outlier Factor（LOF） of the outlier candidated object and detects anomaly attacks.Experimental results demonstrate that it can guarantee higher detection rate and lower false alarm rate.