基于聚类合并的局部离群点挖掘算法在入侵检测中的应用

摘要

According to the problem of high dimension of network security data, the traditional outliers based on cluster cannot ef-fectively detect network intrusion behavior data in detail.This paper put forward an improved DBSCAN algorithm of outlier mining called LDBSCAN-CM.First, this paper introduced a concept of local outlier mining for traditional DBSCAN algorithm, calculated local outlier factors of candidate objects, and generated a number of clusters.Next, this paper merged clusters in order to improve the mining efficiency.Eventually, the KDD Cup99 dataset was applied to conduct simulation experiment on the application of the improved algorithm in intrusion detection.The results indicate that the improved algorithm LDBSCAN-CM can guarantee higher detection rate and lower false alarm rate.%针对网络安全数据的高维度特征问题，传统的基于聚类的检测算法不能有效发现网络数据中入侵行为细节。本文提出一种改进的DBSCAN离群点挖掘算法LDBSCAN-CM，首先在传统DBSCAN算法中引入局部离群点挖掘概念，计算候选对象的局部离群因子，生成若干个聚类；其次，为了提高挖掘效率，在聚类结果的基础上，进行聚类合并；最后，采用KDD Cup99数据集对改进算法在入侵检测中的应用进行仿真实验。实验结果表明，改进算法LDBSCAN-CM能保证较高的检测率和较低的误检率。