关键词: 入侵检测, 数据挖掘, 无监督聚类, 支持向量机

Abstract: An intrusion detection algorithm based on unsupervised clustering (UC) and support vector machine (SVM) is presented via combining the fast speed of UC and the high accuracy of SVM. The basic idea of the algorithm is to decide whether to utilize SVM classifier or not by comparing the distances between the network packets and the cluster centers. So the number of packets going through SVM reduces. Therefore, we can get a tradeoff between the speed and accuracy in the detection. Using KDD99 data sets, the experiment result shows that this approach can detect intrusions efficiently in the network connections.

Key words: intrusion detection, data mining, unsupervised clustering, support vector machines