Abstract: Information entropy theory is applied to the clustering problem for intrusion detection, and the distances for mixed attributes between two data items, data and clusters, and two clusters are defined. By applying overall similarity to evaluate the cluster quality for merging clusters, an unsupervised anomaly detection algorithm based on partition and agglomerative hierarchical clustering, is presented. The algorithm analysis and experimental results show that this algorithm obtains good detection performance and can detect efficiently the new unknown intrusions.

Key words: intrusion detection, partition clustering, agglomerative hierarchical clustering, information entropy

摘要： 将信息熵理论应用于入侵检测的聚类问题，给出在混合属性条件下数据之间距离、数据与簇之间距离、簇与簇之间距离的定义，以整体相似度的聚类质量评价标准作为聚类合并的策略，提出了一种基于划分和凝聚层次聚类的无监督的异常检测算法。算法分析和实验结果表明，该算法具有较好的检测性能并能有效检测出未知入侵行为。

关键词: 入侵检测, 划分聚类, 凝聚层次聚类, 信息熵

CLC Number: 

• TP309