基于人工蜂群优化的密度聚类异常入侵检测算法

Density Clustering Anomaly Intrusion Detection Algorithm Based on ABC-DBSCAN

采用改进的人工蜂群优化算法解决密度聚类异常入侵检测中的参数和特征组合优化问题.首先,在初始化蜜源阶段采用不同的编码方法分别对参数和特征值进行编码;然后,在邻域搜索阶段利用两种搜索策略分别对参数和特征值进行搜索;最后,为满足异常入侵检测对低误报率的需求,在新的适应值函数中加入误报率影响因子.实验结果表明,基于人工蜂群优化的密度聚类异常入侵检测算法不仅提高了正常行为轮廓的精度,而且降低了计算开销和存储空间,并在一定程度上消除噪声特征的干扰,实现了检测性能的提升.

The improved artificial colony optimization algorithm was used to solve the combinatorial optimization problem of parameters and features in density clustering anomaly intrusion detection. Firstly, the parameters and characteristic values were encoded by the different encoding methods in the initial honey source stage. Secondly, two search strategies were used to search the parameters and characteristic values in the neighborhood search stage. Finally, in order to satisfy the requirement of low false positive rate for anomaly intrusion detection, an influence factor of false positive rate was added into the new fitness function. The experimental results show that the improved algorithm not only improves the accuracy of normal behavior profiles, but also reduces the computational cost and storage space. It can eliminate the noise characteristic interference to some extent and improve the detection performance.