基于多重聚类的网络攻击检测方法研究

Research on Network Attack Detection Approach Based on Multi-clustering

提出一种基于多重聚类的网络攻击检测模型(Multi-clustering based network attack detection model,MBNADM).首先,采用改进空间聚类算法(Improved spatial clustering,ISC)进行空间聚类;其次,采用改进密度聚类算法(Improved density based clustering,IDBC)对空间数据集进行细粒度的二次聚合分类并对k值进行设定;最后,采用改进证据累积聚类算法(Improved evidence accumulation clustering,IEAC)计算各个孤立点与类簇质心的相异距离值,运用矩阵聚类算法计算检测阈值并判定网络中的攻击行为.通过基于KDD99数据集的攻击检测实验和与不同方法的检测对比实验证明了MBNADM具有较高的检测率和较低的误报率.

This paper presents a new multi-clustering based network attack detection model（MBNADM）.Firstly,the improved spatial clustering（ISC）algorithm was designed to clustering subspace.Secondly,the improved density based clustering（IDBC）algorithm was used to complete the fine-grained aggregation operation on the spatial data sets and the k value setting.Finally,the distinct distance values among each isolated point（network attack）and clustered centroid were calculated with the improved evidence accumulation clustering（IEAC）algorithm,then the matrix clustering algorithm was used to calculate the detection threshold and consequently the network attacks in network behaviors were determined.The attack detection experiments on KDD99 dataset and the detection comparison experiment of different detection methods demonstrate that the MBNADM method has a high detection rate and low false positive rate.