关键词: 集对分析, 网络异常检测, 半监督聚类, 迭代自组织数据分析方法（ISODATA）

Abstract: A semi-supervised ISODATA clustering algorithm based on the Set Pair Analysis（SPA） is proposed for network anomaly detection.This paper improves the original ISODATA algorithm mainly in three aspects.Firstly，the modified algorithm can directly process the mixed attributes of symbolic and numeric values，and employ the SPA to calculate the distance between data records.Secondly，the algorithm can process both labeled and unlabeled samples.The small portion of labeled samples is used to supervise the clustering process in the splitting stage.Thirdly，the initial parameters needed to be input into the algorithm are reduced to only two.Experimental result on the KDD 99 intrusion detection datasets shows that the algorithm has high detection rate（95.62%） while maintaining a low false positive rate（1.29%）.

Key words: set pair analysis, network anomaly detection, semi-supervised clustering, Iterative Self-Organizing Data Analysis Technique（ISODATA）