关键词: 聚类分析, 缺失属性, 支持向量机, 最近邻间隔

Abstract: Due to including missing features and a large number of non-attack samples, real-time attack data set present incomplete feature distribution and skewed class distribution, which is adverse to clustering analysis. To solve this problem, a two-phase clustering algorithm for incomplete attack data set is proposed. Firstly, standard two-class support vector machine is used to separate non-attack samples and balance the class distribution. Secondly, a method of measuring the distance between incomplete samples is proposed. Then, this method is applied in the nearest-neighbor interval fuzzy C-means algorithm to implement clustering. Experimental results show that, this algorithm has better performance on clustering accuracy than existing algorithms.

Key words: clustering analysis, missing feature, support vector machine, nearest-neighbor interval