Abstract: A hybrid method of improved Linear Discriminant Analysis（LDA） and Center-based Nearest Neighbor（CNN） classifier for clustering of network intrusions is proposed. The improved LDA is employed to reduce the dimensions of sample vector, and then the center-based nearest neighbor classifier is used to cluster for the data of network intrusions. The proposed algorithm not only reduces the clustering time of the algorithm, but also improves the clustering ability. Experimental results indicate that the proposed algorithm obtains higher clustering capability contrast to other models at a higher detection rate and a lower false alarm rate.

Key words: linear discriminant analysis, center-based nearest neighbor, network intrusions, clustering, dimension reduction

摘要： 提出了一种基于改进线性判别分析和近邻法的网络入侵聚类方法，运用改进的线性判别分析方法对网络入侵样本特征进行降维处理，使用近邻分类器对数据进行聚类。该算法降低了算法的聚类时间，还提高了算法的聚类能力。实验结果表明，相比其他模型，该算法有较高的检测率和较低的误警率。

关键词: 线性判别分析, 中心近邻法, 网络入侵, 聚类, 降维