【摘要】 提出一种基于改进密度聚类的异常检测算法(ADIDC),通过在各特征列上分别进行密度聚类,并根据各特征对正常轮廓的支持度进行特征加权,解决了聚类分析方法在异常检测应用中误报率较高的问题.通过大量基于异常检测数据集KDD Cup 1999的实验表明,其相对于传统异常检测方法在保证较高检测率的前提下,有效地降低了误报率,对某些与正常行为相近的特殊攻击检测率明显提高.同时利用特征权值进行特征筛选提高了其检测性能和效率,更适应实时检测要求.更多还原

【Abstract】 This paper proposes an Anomaly Detection algorithm based on Improved Density Clustering(ADIDC).The improved algorithm adopts clustering features separately on individual characteristic arranges and weighting features by the correlativity between the features and the normal profile.It can solve the frequent problem of the high false positive rate on clustering in the application of anomaly detection.A series of experiments on well known KDD Cup 1999 dataset demonstrates that it has a lower false positive rate,especially ensuring high detection rate with respect to the traditional anomaly detection methods.The detection of the special attack which resembles the normal act is obviously improved.In addtion,the detection performace can be further optimized by feature selection via feature weights.It makes the proposed algorithm more suitable for the real-time detection.更多还原