基于极值距离双轨调整策略的入侵检测算法

Application of improved K-means algorithm based on dual-track adjustment strategy of extreme value in intrusion detection

目的针对入侵检测算法存在检测率低、误报率高等问题,提出基于密度极值距离双轨调整策略的改进K-means算法(K-DTEV算法)。方法该算法使用新的噪声数据处理方法和2个新的改进策略(最优阈值判定策略、初始点中心选择策略),能够消除阈值参数对点密度大小的影响,准确判断高密度点和噪声数据,进而优化初始中心点的选取。结果与结论本文使用改进算法与K-means算法和PDSK-means进行比较,结果表明K-DTEV算法在检测率、误检率等评价指标上均优于对比算法。

Purposes—To propose an improved K-means algorithm(K-DTEV algorithm)based on dual-track adjustment strategy of extreme density distance for the purpose of solving the problems of low detection rate and high false positive rate in instrusion detection algorithm.Methods—In this algorithm,a new noise data processing method and two new improved strategies(optimal threshold decision strategy and initial point center selection strategy)are used to eliminate the influence of threshold parameters on point density,accurately judge high density points and noise data,and optimize the selection of initial center point.Result and Conclusion—The results show that compared with K-means algorithm and PDSK-means,K-DTEV algorithm,the improved algorithm,is superior to the comparison algorithms in terms of evaluation indexes such as detection rate and false detection rate.