关键词: 异常检测, 在线聚类, 数据精简, 自组织增量神经网络, 最近邻分类器

Abstract: An ideal Intrusion Detection System（IDS） should implement unsupervised learning and online learning. Existing methods suffice these two criterions requires too much training time, which would cause a high packet loss rate and is unacceptable. To overcome the difficulty, an intrusion detection method based on improved Self-Organizing Incremental Neural Network（SOINN） and data reduction is presented, which allows online training of network classifiers in an unsupervised fashion. Also, data reduction methods, including random subset selection, k-means clustering, and principle component analysis are employed to accelerate the training. Experimental results show that the proposed method requires less time in training while maintaining a high detection rate.

Key words: anomaly detection, online clustering, data reduction, Self-Organizing Incremental Neural Network（SOINN）, nearest neighbor classifier