基于k-means算法的入侵检测研究

Research of Intrusion Detection Based on Improved K-means Algorithm

针对原始k-means算法存在问题,提出一种无需指定k值和初始聚类中心的能够依据数据集内在特性自动完成聚类的改进k-means算法。最后,利用入侵检测领域应用最为广泛的数据集KDDCUP99验证了改进算法的性能。实验结果表明,改进算法无需任何输入,且具有较高的检测率和较低的误报率,性能较原始算法均有提高。

Aiming at the problems of the original k-means algorithm, an improved k-means algorithm is proposed, which can automatically complete clustering without specifying the k value and the initial clustering center according to the inherent characteristics of the data set. Finally, the performance of the improved algorithm is verified by using KDD CUP99, which is the most widely used data set in the field of intrusion detection. The experimental results show that the improved algorithm does not need any input, and has higher detection rate and lower false alarm rate. Its performance is improved compared with the original algorithm.