• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>International Conference on Information Science and Cloud Computing Companion >Research of Clustering Algorithm Based on Information Entropy and Frequency Sensitive Discrepancy Metric in Anomaly Detection
【24h】

Research of Clustering Algorithm Based on Information Entropy and Frequency Sensitive Discrepancy Metric in Anomaly Detection

机译：基于信息熵和频率敏感差异度量在异常检测中的聚类算法研究

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Anomaly detection is an active branch of intrusion detection technology which can detect intrusion behaviors including system or users' non-normal behavior and unauthorized use of computer resources. Clustering analysis is an unsupervised method to group data set into multiple clusters. Using clustering algorithm to detect anomaly behavior has good scalability and adaptability. This paper mainly focuses on improving k-means clustering algorithm, and uses it to detect the abnormal records. Our goal is to increase the DR value and decrease the FAR value in anomaly detection by calculating appropriate value of parameters and improve the clustering algorithm. In our IE&FSDM algorithm, we use network records' minimum standard information entropy to compute the initial cluster centers. In testing phase, discrepancy metric is introduced to help calculate exact number of clusters in testing data set. Using the results of initial cluster centers calculated in the pre-phase, IE&FSDM compute the actual clusters by converging cluster centers and obtains the actual cluster centers according to the frequency sensitive discrepancy metric. Then comply with the improved k-means algorithm, iterative calculate until divide all network data into corresponding clusters, and according to the results of cluster we can classify the normal and abnormal network behaviors. At last, we use KDD CUP1999 dataset to implement IE&FSDM algorithm. Test results show that comparing with previous clustering methods, IE&FSDM algorithm improve the detection rate of anomaly behavior and reduce the false alarm rate.
机译：异常检测是入侵检测技术的活动分支，可以检测入侵行为，包括系统或用户的非正常行为和未经授权使用计算机资源。群集分析是将数据集合到多个集群中的无监督方法。使用聚类算法检测异常行为具有良好的可扩展性和适应性。本文主要侧重于改善K-Means聚类算法，并使用它来检测异常记录。我们的目标是通过计算适当的参数值并提高聚类算法来增加DR值并降低异常检测的远值。在我们的IE＆FSDM算法中，我们使用网络记录的最小标准信息熵来计算初始集群中心。在测试阶段，引入差异度量来帮助计算测试数据集中的确切簇数。使用在预相中计算的初始群集中心的结果，IE＆FSDM通过融合集群中心来计算实际群集，并根据频率敏感的差异度量来获得实际的集群中心。然后符合改进的k均值算法，迭代计算直到将所有网络数据划分为相应的群集，并且根据群集的结果，我们可以对正常和异常的网络行为进行分类。最后，我们使用KDD Cup1999数据集来实现IE和FSDM算法。测试结果表明，与先前的聚类方法相比，IE＆FSDM算法提高了异常行为的检测率，降低了误报率。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号