基于特征分组聚类的异常入侵检测系统研究

doi:10.19678/j.issn.1000-3428.0054476

计算机工程 ›› 2020, Vol. 46 ›› Issue (4): 123-128,134. doi: 10.19678/j.issn.1000-3428.0054476

基于特征分组聚类的异常入侵检测系统研究

何发镁^1,2, 马慧珍^2,3, 王旭仁^2,3, 冯安然^2,3

1. 北京理工大学图书馆, 北京 100081;
2. 中国科学院信息工程研究所中国科学院网络测评技术重点实验室, 北京 100093;
3. 首都师范大学信息工程学院, 北京 100048

收稿日期:2019-04-03 修回日期:2019-05-11 出版日期:2020-04-15 发布日期:2019-05-23
作者简介:何发镁(1972-),男,博士,主研方向为数据挖掘、情报分析;马慧珍,硕士研究生;王旭仁,副教授、博士;冯安然,硕士研究生。
基金资助:
国家自然科学基金（61872252）。

Research on Anomaly Intrusion Detection System Based on Feature Grouping Clustering

HE Famei^1,2, MA Huizhen^2,3, WANG Xuren^2,3, FENG Anran^2,3

1. Library, Beijing Institute of Technology, Beijing 100081, China;
2. Key Laboratory of Network Assessment Technology, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China;
3. Information Engineering College, Capital Normal University, Beijing 100048, China

Received:2019-04-03 Revised:2019-05-11 Online:2020-04-15 Published:2019-05-23

摘要/Abstract

摘要： 利用网络连接数据可以按照连接的基本特征、内容特征、网络流量特征和主机流量特征进行分组的特点，基于K-means算法，提出一种按照特征分组进行聚类的方法，以高效实现特征约简和数据降维。通过调整聚类参数保留特征分组内的差异信息，使用决策树C4.5算法对降维后的数据进行入侵分类处理。实验结果表明，该方法能够使kddcup99数据集的聚类特征数由41个降为4个，且对网络连接数据的总检测率为99.73%，误检率为0，其中正常网络连接和刺探攻击Probe的检测率均为100%。

关键词: 入侵检测, 网络数据, K-means算法, 决策树, 数据降维

Abstract: The network connection data can execute feature grouping according to the basic features of connection,the content features,the network traffic features and the host features.Taking advantage of this characteristic,this paper proposes a K-means based clustering method according to the grouping of features,so as to effectively achieve feature reduction and data dimensionality reduction.The differential information within the feature groups are retained by adjusting clustering parameters,and the decision tree C4.5 algorithm is used for intrusion classification of the data after dimensionality reduction.Experimental results show that the proposed method can reduce the number of clustering features of kddcup99 dataset from 41 to 4.The overall detection rate on network connection data is 99.73%,the false detection rate is 0 and the detection rates of normal network connection and Probe attack are both 100%.

Key words: intrusion detection, network data, K-means algorithm, decision tree, data dimensionality reduction

中图分类号:

TP391

何发镁, 马慧珍, 王旭仁, 冯安然. 基于特征分组聚类的异常入侵检测系统研究[J]. 计算机工程, 2020, 46(4): 123-128,134.

HE Famei, MA Huizhen, WANG Xuren, FENG Anran. Research on Anomaly Intrusion Detection System Based on Feature Grouping Clustering[J]. Computer Engineering, 2020, 46(4): 123-128,134.

https://www.ecice06.com/CN/Y2020/V46/I4/123

图/表 13

20200414124619

20200414124623

20200414124627

20200414124631

20200414124635

20200414124639

20200414124642

20200414124646

20200414124650

20200414124653

20200414124657

20200414124701

20200414124705

参考文献 21

[1]	ZHANG Cuixiao,ZHANG Guobing,SUN Shanshan.A mixed unsupervised clustering based intrusion detection model[C]//Proceedings of the 3rd International Conference on Genetic and Evolutionary Computing.Washington D.C.,USA:IEEE Press,2009:426-428.
[2]	MENG Jianliang,SHANG Haikun,BIAN Ling.The application on intrusion detection based on K-means cluster algorithm[C]//Proceedings of International Forum on Information Technology and Application.Washington D.C.,USA:IEEE Press,2009:150-152.
[3]	PATHAK V,ANATHANARAYANA V S.A novel multi-threaded K-means clustering approach for intrusion detection[C]//Proceedings of 2012 IEEE International Conference on Software Engineering and Service Science.Washington D.C.,USA:IEEE Press,2012:757-760.
[4]	LUO Min,WANG Lina,ZHANG Huanguo.An unsupervised clustering-based intrusion detection method[J].Acta Electronica Sini
[11]	MUDA Z,YASSIN W,SULAIMAN M N,et al.Intrusion detection based on K-Means clustering and Naïve Bayes classification[C]//Proceedings of International Conference on Information Technology in Asia.Washington D.C.,USA:IEEE Press,2011:1-6.
[12]	YASSIN W,UDZIR N,MUDA Z,et al.Anomaly-based intrusion detection through K-means clustering and Naives Bayes classification[C]//Proceedings of the 4th International Conference on Computing and Informatics.Washington D.C.,USA:IEEE Press,2013:298-303.
[13]	FACHKHA C,HARB E B,DEBBABI M.Inferring distributed reflection denial of service attacks from darknet[J].Computer Communications,2015,62(1/2):59-71.
[14]	CHANDRASEKHAR A,RAGHUVEER K.Intrusion detection technique by using K-means,fuzzy neural network and SVM classifiers[C]//Proceedings of International Conference on Computer Communication and Informatics.Washington D.C.,USA:IEEE Press,2013:1-7.
[15]	YASEEN W A,OTHMAN Z,NAZRI M.Multi-level hybrid support vector machine and extreme learning machine based on modified K-means for intrusion detection system[J].Expert Systems with Applications,2017,6(7):296-303.
[16]	HE Liang.An improved intrusion detection based on neural network and fuzzy algorithm[J].Journal of Networks,2014,9(5):1274-1280.
[17]	WU Yuwen,LIU Hong,ZHA Hongbin.Facial expression recognition by weighted clustering of grouped features[J].Journal of Computer-Aided Design and Computer Graphics,2005,17(11):2394-2401.(in Chinese)武宇文,刘宏,查红彬.基于特征分组加权聚类的表情识别[J].计算机辅助设计与图形学学报,2005,17(11):2394-2401.
[18]	QUINLAN J R.Induction of decision trees[J].Machine Learning,1986,1(1):81-106.
[19]	QUINLAN J R.C4.5:programs for machine learning[M].[S.l.]:Morgan Kaufmann Publisher,1993.
[20]	HETTICH S,BAY S D.KDD cup 1999 data[EB/OL].[2019-03-20].http://kdd.ics.uci.edu/databases/kdd cup99/kdd cup99.html.
[21]	BOUZIDA Y,CUPPENS F,BOULAHIA N C,et al.Efficient intrusion detection using principal component analysis[C]//Proceedings of 2010 International Conference on Engineering System Management and Applications.Washington D.C.,USA:IEEE Press,2010:256-268.

[1]	翟洁, 李艳豪, 李彬彬, 郭卫斌. 基于大语言模型的个性化实验报告评语自动生成与应用[J]. 计算机工程, 2024, 50(7): 42-52.
[2]	余长宏, 许孔豪, 张泽, 高明. 基于分割点改进孤立森林的网络入侵检测方法[J]. 计算机工程, 2024, 50(6): 148-156.
[3]	张慧妍, 梁勇, 兰景宏, 赵强. 基于记忆模块与过滤式生成对抗网络的入侵检测方法[J]. 计算机工程, 2024, 50(6): 197-207.
[4]	陈虹, 王瀚文, 金海波. 融合改进自编码器和残差网络的入侵检测模型[J]. 计算机工程, 2024, 50(2): 188-195.
[5]	谢兆贤, 邹兴敏, 张文静. 面向大型数据集的高效决策树参数剪枝算法[J]. 计算机工程, 2024, 50(1): 156-165.
[6]	陈仲磊, 伊鹏, 陈祥, 胡涛. 基于集成学习的系统调用实时异常检测框架[J]. 计算机工程, 2023, 49(6): 162-169,179.
[7]	王博, 张远, 杨咏蓓. 基于模仿学习的决策树码率自适应算法研究[J]. 计算机工程, 2023, 49(5): 206-214.
[8]	张雷, 鲍蓉, 朱永红, 史新国. 基于CSA-ResNet的人员入侵检测方法[J]. 计算机工程, 2023, 49(4): 297-302,311.
[9]	石磊, 张吉涛, 高宇飞, 卫琳, 陶永才. 基于Transformer与BiLSTM的网络流量入侵检测[J]. 计算机工程, 2023, 49(3): 29-36,57.
[10]	刘强, 张颖, 周卫祥, 蒋先涛, 周薇娜, 周谋国. 自适应类增量学习的物联网入侵检测系统[J]. 计算机工程, 2023, 49(2): 169-174.
[11]	陈天宇, 楚程钱, 万思远, 万永菁, 孙静. 基于条件轻量级神经网络的视频入侵检测算法[J]. 计算机工程, 2023, 49(12): 152-160.
[12]	林洪秀, 邢长友, 詹熙. 对抗多模式网络层析成像的拓扑混淆机制[J]. 计算机工程, 2023, 49(12): 282-293, 303.
[13]	刘金硕, 詹岱依, 邓娟, 王丽娜. 基于深度神经网络和联邦学习的网络入侵检测[J]. 计算机工程, 2023, 49(1): 15-21,30.
[14]	孙扬威, 戚湧. 基于聚类混合采样与PSO-Stacking的车载CAN入侵检测方法[J]. 计算机工程, 2023, 49(1): 138-145.
[15]	董卫宇, 李海涛, 王瑞敏, 任化娟, 孙雪凯. 基于堆叠卷积注意力的网络流量异常检测模型[J]. 计算机工程, 2022, 48(9): 12-19.

选择文件类型/文献管理软件名称

选择包含的内容

基于特征分组聚类的异常入侵检测系统研究

Research on Anomaly Intrusion Detection System Based on Feature Grouping Clustering

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 13

参考文献 21

相关文章 15

编辑推荐

Metrics

本文评价

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

基于特征分组聚类的异常入侵检测系统研究

Research on Anomaly Intrusion Detection System Based on Feature Grouping Clustering

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 13

参考文献 21

相关文章 15

编辑推荐

Metrics

本文评价