基于谱聚类的网络入侵检测算法研究

Research on network intrusion detection algorithm based on spectral clustering

针对传统聚类分析算法在入侵检测中存在的问题,提出基于谱聚类的入侵检测算法。阐述入侵检测与聚类分析相结合的优势,并分析几种入侵检测系统中常用的聚类方法。谱聚类算法可以在任意形状的样本空间上聚类,并能获得全局最优解。将谱聚类用在经典的入侵检测数据集KDD CUP99中,实验结果表明,与基于K-means的入侵检测方法相比,该方法有较高的检测率和较低的误检率。

Aiming at the problem of traditional clustering analysis algorithm in intrusion detection, an intrusion detection algorithm based on spectral clustering is proposed. The advantages of combining intrusion detection and cluster analysis are described, and the commonly used clustering methods in several intrusion detection systems are analyzed. Spectral clustering algorithm can cluster on any shape of the sample space, and can obtain a global optimization solution. Using spectral clustering algorithm to the classic intrusion detection data set KDD CUP99, and comparing to the intrusion detection method based on K-means, the experiment results show that this algorithm has higher detection rate and lower false detection rate.