基于密度和最优聚类数的入侵检测方法

针对聚类算法在入侵检测应用中存在的参数预设、聚类有效性评价、未知攻击类型检测等问题，提出了一种基于密度和最优聚类数的改进算法，根据样本的分布情况启发式地确定初始聚类中心，从样本的几何结构角度提出一种新的内部评价指标，给出了最优聚类数确定方法，在此基础上，设计了一个增量式的入侵检测模型，实现了聚类中心和聚类数目的动态调整.实验结果表明，与K-means及其他两种改进聚类算法相比，新算法收敛速度更快、聚类准确率更高，能够对未知网络行为进行有效聚类，具有较好的入侵检测效果.

Intrusion Detection Method Based on Density and Optimal Clustering Number

According to the problems of clustering algorithm in the application of intrusion detection, such as parameter presupposition, clustering effectiveness evaluation and unknown attack type detection, an improved algorithm based on density and optimal clustering number has been proposed. And according to the distribution of the samples, the initial clustering center has been determined heuristically, a new internal evaluation index has been proposed from the point of view of the geometric structure of the samples, and the optimal clustering number has been determined. On this basis, an incremental intrusion detection model has been designed to realize the dynamic adjustment of the clustering center and the number of clusters. Experimental results show that compared with K-means and other two improved clustering algorithms, the new algorithm has faster convergence speed and higher clustering accuracy, and can effectively cluster unknown network behaviors, and has better intrusion detection effect.