ID—DC：基于分布式聚类的人侵检测方法

提出了基于分布式聚类的异常入侵检测方法ID—DC，通过对训练集进行分布式聚类产生聚簇模型，采用基于双参考点的标识算法Double—Reference标记异常簇，不需要具有类别标签的训练集且可自动确定聚簇模型的个数．实验中采用了网络入侵检测数据集KDD—CUP-99来训练模型．实验结果表明：通过采用分布式聚类算法建立的分布式入侵检测模型可有效地检测攻击，检测率高，误警率低．

ID-DC.Intrusion Detection Based on Distributed Clustering

In this paper, an effective and anomaly distributed detection algorithm ID-DC based on clustering is proposed to realize the DIDS. Algorithm ID-DC, which first get cluster models by using the distributed clustering algorithm on unlabeled training data and then labels these models through algorithm Double-Reference, overcomes the drawbacks of relying on labeled training data which most current anomaly-based intrusion detection depend on and expects to automatically partition the data set into a reasonable number of clusters. At last, the experiments on the KDD -CUP-99 data records of network connections show that our distributed clustering algorithm can efficiently detect intrusions while maintaining a low false positive rate.