Abstract: There are two major problems exist in commonly used clustering algorithm for intrusion detection systems：One is clustering algorithm that uses the random method to determine initial cluster centers，the other is that it is easy to fall into local optimal solution caused by climbing-type technology.Based on this，an improved clustering algorithm is proposed.By determining the initial cluster centers of the two farthest，hierarchical clustering based on the maximum-minimum distance and DBI index it determines the remaining initial cluster center，the method solves the mentioned issue.The simulation verifies the feasibility and superiority of the proposed algorithm.

Key words: intrusion detection, cluster analysis, K-means algorithm

摘要： 针对常用聚类分析算法应用于入侵检测系统所存在的两大方面的问题：一是其采用随机法确定初始聚类中心，不同的初始值可能产生不同的聚类结果；二是采用爬山式技术导致容易陷入局部最优解。基于此提出一种改进的聚类分析算法，通过确定两个最远初始聚类中心和基于最大最小距离的层次聚类、DBI指标来确定剩余初始聚类中心，该方法使上述问题得到解决，并通过仿真实验验证了该算法的可行性和优越性。

关键词: 入侵检测, 聚类分析, K-means算法