基于两步模糊聚类算法的网络入侵检测应用

Application of Network Intrusion Detection Based on Two-steps Fuzzy Clustering

摘要: 模糊C-均值算法（FCM）广泛应用于入侵检测中，在其基础上为了更有效实现入侵数据的划分，应用了基于阴影集的粗糙模糊聚类算法（SRFCM）.同时，为提高检测性能提出了一种新的“两步走”方法：首先运用算法将网络数据划分为正常和入侵两种类型，其次再运用算法将入侵数据划分为不同的攻击类型，有效提高了检测性能.本文采用KDDCUP1999数据集进行仿真实验，实验表明“两步走”方法在入侵检测中获得了较高的检测率.

Abstract: Fuzzy C-means clustering algorithm (FCM) is widely applied to the intrusion detection.To achieve effective division for intrusion data,a rough fuzzy clustering algorithm based on the shadow set is applied in this study.Besides,a new measure named ‘two-steps′is proposed to improve detection performance in this paper.The first step is to divide the network data into normal and intrusion types.The second step is to divide the intrusion data into specific types.This measure can improve detection performance effectively.In the simulation experiment,the KDDCUP1999 data set is used.The results of the experiment proved that the ‘two-steps′ algorithm had a relatively high detection rate in intrusion detection.