Abstract: This paper proposes an optimized K-means clustering algorithm based on improved Simulated Annealing（SA-KM） to overcome K-means’inadequacy for global search. The proposed method is more advantageous than K-means, which is not sensitive to the initial clustering center. In order to improve clustering partition quality of SA-KM algorithm, an assessment function for assessing clustering result is presented for the proposed algorithm, which reflects intra-class distance and inter-class distance more accurately. The simulation results demonstrate that the proposed algorithm can detect various intrusion behaviors in intrusion detection, as well as maintain higher network intrusion detection rate and lower false acceptance rate of network intrusion.

Key words: K-means clustering, improved simulated annealing algorithm, assessment function, intrusion detection

摘要： 针对K-means算法全局搜索能力的不足，提出了一种基于改进模拟退火的优化K-means（SA-KM）的聚类算法，该算法克服了K-means聚类算法对初始聚类中心选择敏感问题。为了提高SA-KM算法的聚类划分质量，提出了一种用于评价聚类结果的评价函数，该函数更为准确地反映类内距离和类间距离。仿真结果表明使用该算法在进行入侵检测时，能够检测出多种类型的入侵行为，能够保持较高的网络入侵检测率和较低网络入侵的误报率。

关键词: K-means聚类, 改进的模拟退火算法, 评价函数, 入侵检测