计算机工程与应用 ›› 2012, Vol. 48 ›› Issue (6): 5-8.

• 博士论坛 • 上一篇    下一篇

改进的FCM算法在网络入侵检测中的应用

唐德玉1,齐德昱2,蔡先发2,胡镜林3   

  1. 1.广东药学院 医药信息工程学院 计算机系,广州 510006
    2.华南理工大学 计算机科学与工程学院 计算机系,广州 510006
    3.南昌航空大学 信息工程学院 计算机系,南昌 330063
  • 收稿日期:1900-01-01 修回日期:1900-01-01 出版日期:2012-02-21 发布日期:2012-02-21

Application of improved FCM algorithm to network intrude detection

TANG Deyu1, QI Deyu2, CAI Xianfa2, HU Jinglin3   

  1. 1.Dept. of Computer, College of Medical Information and Engineering, Guangdong Pharmaceutical University, Guangzhou 510006, China
    2.Dept. of Computer, College of Computer Science and Engineering, South China University of Technology, Guangzhou 510006, China
    3.Dept. of Computer, College of Information and Engineering, Nanchang Hangkong University, Nanchang 330063, China
  • Received:1900-01-01 Revised:1900-01-01 Online:2012-02-21 Published:2012-02-21

摘要: 针对FCM聚类算法容易陷入局部最优且对初始点很敏感的问题,提出基于搜索空间平滑技术的点密度加权FCM算法以获得最优解。以所得的聚类中心作为输入,再次执行FCM算法,对于隶属度小于阈值的数据样本进行检测;如果该数据样本被删除,目标函数值变化明显,则该数据样本为异常数据样本,并且聚类最后产生的小的簇中的数据样本也是异常数据样本。在KDDCUP99数据集上进行检测,实验结果表明该算法具有较高的检测率及较低的误检率。

关键词: 入侵检测, 搜索空间平滑, 3SW-FCM算法, D-FCM算法

Abstract: In view of the problem that FCM(Fuzzy C-Means) cluster algorithm easily traps in a local optimum and strongly depends on the initialization, this paper proposes a point density weighted FCM based on search space smoothing technique to get a global optimum. Input by obtained cluster centers, it implements FCM algorithm again, checking the data point when it’s membership value is smaller than the threshold, and if it is deleted, the objective function value changes obviously, then this data point is an abnormal data point, and the final small cluster should be abnormal data points. The experimental results based on the datum of KDDCUP99(Knowledge Discovery and Data Mining Cup 99) demonstrate that the algorithm possesses higher detection rate and lower misuse detection rate.

Key words: intrude detection, search space smoothing, 3SW-FCM algorithm, D-FCM algorithm