作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2008, Vol. 34 ›› Issue (2): 120-123. doi: 10.3969/j.issn.1000-3428.2008.02.040

• 安全技术 • 上一篇    下一篇

基于划分和凝聚层次聚类的无监督异常检测

李 娜,钟 诚   

  1. (广西大学计算机与电子信息学院,南宁 530004)
  • 收稿日期:1900-01-01 修回日期:1900-01-01 出版日期:2008-01-20 发布日期:2008-01-20

Unsupervised Anomaly Detection Based on Partition and Agglomerative Hierarchical Clustering

LI Na, ZHONG Cheng   

  1. (School of Computer and Electronics and Information, Guangxi University, Nanning 530004)
  • Received:1900-01-01 Revised:1900-01-01 Online:2008-01-20 Published:2008-01-20

摘要: 将信息熵理论应用于入侵检测的聚类问题,给出在混合属性条件下数据之间距离、数据与簇之间距离、簇与簇之间距离的定义,以整体相似度的聚类质量评价标准作为聚类合并的策略,提出了一种基于划分和凝聚层次聚类的无监督的异常检测算法。算法分析和实验结果表明,该算法具有较好的检测性能并能有效检测出未知入侵行为。

关键词: 入侵检测, 划分聚类, 凝聚层次聚类, 信息熵

Abstract: Information entropy theory is applied to the clustering problem for intrusion detection, and the distances for mixed attributes between two data items, data and clusters, and two clusters are defined. By applying overall similarity to evaluate the cluster quality for merging clusters, an unsupervised anomaly detection algorithm based on partition and agglomerative hierarchical clustering, is presented. The algorithm analysis and experimental results show that this algorithm obtains good detection performance and can detect efficiently the new unknown intrusions.

Key words: intrusion detection, partition clustering, agglomerative hierarchical clustering, information entropy

中图分类号: