Abstract: Because collecting labeled samples is more difficult than collecting unlabeled samples and network data include value attribute and symbol attribute, this paper proposes an improved semi-supervised fuzzy clustering algorithm based on heterogeneous distance and sample density for intrusion detection. The algorithm computes membership with sample density of one class and heterogeneous distance of intrusion detection dataset. Then it computes distance between sample and the center of every class and sets sample belonging to class of min-distance. It makes experiment with KDDCUP99 dataset, and experimental results show that the method improves the detection accuracy.

Key words: intrusion detection, semi-supervised clustering, heterogeneous datasets

摘要： 针对网络行为数据中带标签数据收集困难及网络行为数据的异构性，提出了一种基于异构距离和样本密度的半监督模糊聚类算法，并将该算法应用到网络入侵检测中。该方法依据网络行为数据样本的异构性计算样本与类之间的异构距离及各个类的样本密度，利用异构距离和类内样本密度计算样本与类之间的模糊隶属度，用所得隶属度对无标签样本进行加标签处理，并得到相应的分类器。在KDD CUP99数据集上进行仿真实验，结果表明该方法是可行的、高效的。

关键词: 入侵检测, 半监督聚类, 异构数据