基于DCFCM模糊聚类的入侵检测方法研究

作为一种主动的信息安全保障措施,入侵检测技术有效地弥补了传统安全保护机制所不能解决的问题.先进的检测算法是入侵检测研究的关键技术.首先提出新的相似度函数Dsim(),有效地解决了高维空间聚类选维和降维问题,实现了高效的聚类;接着将Dsim()与近似K-medians算法相结合,提出了新的模糊聚类算法----DCFCM,并将其用于入侵检测.解决了由尖锐边界、孤立点所带来的误报警和漏报警问题,实现了对异常行为的检测.仿真实验结果表明,该系统对网络正常数据和异常数据聚类,进行动态数据分析,实现异常检测的思想是有效的.在网络入侵数据检测中,DCFCM算法相对于传统的FCM算法有较高的检测率和较低的误警率.

Research on Intrusion Detection Method based on DCFCM Fuzzy Clustering

The Intrusion Detection technology, a new and active security technology, compensated the defects of traditional protection mechanism system with great effectiveness. Advanced detective technology is a key factor in the research on intrusion detection. In the paper, a modified Similarity Measure Function, called Dsim( ), is proposed in order to solve the problem of non-contrasting behavior high dimensional space, and then a learning algorithm, called DCFCM, is advanced through the combination of Dsim( ) and Approximated K-median and applied in intrusion detection which solves the problem of sharp border effecting problems and realizes the detection of abnormal incurrence. The result of emulation examinations shows that the system is effective in the analysis of changing statistics and realization of detection of abnormal behaviors. In the detection of intrusive data, DCFCM is highly detective and less false-alarming in contrast with traditional FCM algorithm.