关键词: 入侵检测, 数据挖掘, 聚类算法, K-means聚类, 最小支撑树

Abstract: An improved K-means clustering algorithm is put forward on basis of the split-merge method for the purpose of remedying defects both in determination of value in K and in selection of initial cluster centre of traditional K-means clustering. The concept of independence degree of date is incorporated into the experimental date subset construction theory, using independence degree to evaluate the importance of nature. The database is merged into several classes in respect of density of date points, the combination of the minimum spanning tree algorithm and traditional K-means clustering algorithm is conducive to the achievement of splitting. The KDD Cup99 database is applied to conduct simulation experiment on the application of the improved algorithm in intrusion detection. The results indicate that the improved algorithm prevails over traditional K-means algorithm in detection rate and false alarm rate.

Key words: intrusion detection, data mining, clustering algorithm, K-means clustering, minimum spanning tree