基于k-means和决策树的混合入侵检测算法

Mixed Intrusion Detection Algorithm Based on k-means and Decision Tree

随着网络复杂度的增加,传统的入侵检测方法已经无法满足日益增长的安全需求。采用大数据的挖掘算法提高入侵检测的检测率是当前研究的热点。为此,本文提出一种基于k-means和决策树算法的混合入侵检测算法(KDI)。该算法首先对数据预处理的离散化方法进行改进,获取高质量样本数据,并根据现实中易出现类别信息增益比差异小的特点,利用k-means算法根据增益比差异将样本数据先分类再建立决策树,提升了算法的检测率。实验结果表明KDI算法能够有效地检测网络数据中隐含的已知和未知的入侵行为。

With the growth of the network complexity,the traditional intrusion detection methods have been unable to meet thehigh-level security requirements. How to use data mining algorithm to improve accuracy rate of intrusion detection is a hot spot incurrent research. For H s purpose, a hybrid intrusion detection algorithmbased on k-means and decision trproposed. Firstly, an improvement on data discretization method is advanced,in order to othen the k-mean algoritlim is utilized to classify the sample data based on the feature vergence ratio in many real situations, subsequently, the decision trees is constructed, therefore, the deteThe experimental results show that the KDI algorithm can effectively detect both known and unknownetwork data.