基于聚类分析的入侵检测算法研究

【作者】 赵晖；

【导师】 房鼎益；

【作者基本信息】 西北大学 ， 计算机软件与理论， 2011， 硕士

【摘要】 随着计算机网络技术的快速发展,其应用领域不断扩大,人类生活也越来越多地依赖于计算机网络,网络安全问题成为一个人们关注的研究热点。入侵检测技术是当今一种非常重要的动态安全技术,它与静态防火墙技术等共同使用,可以大大提高系统的安全防护水平。本文系统的介绍了入侵检测的概念、发展、与防火墙的关系、基本原理、工作模式、分类及发展趋势。聚类分析是数据挖掘中一项重要的技术,它是一种无监督学习,不需要先验知识,不需要人工指导,就能够按照数据集自身属性的相关特征把对象划分为一系列有意义的数据子集。本文介绍了聚类技术的概念、常用相似度度量距离函数、常用相似系数、聚类分析的基本步骤。重点分析了模糊c-均值聚类的原理、步骤、优势与缺陷。本文提出了一种基于粒子群优化的模糊c-均值聚类算法,并把该算法应用到入侵检测中。模糊c-均值聚类算法是一种基于目标函数的聚类方法,由于在目标函数中存在许多局部极小点,算法的每一次迭代都是根据目标函数减小的方向进行,这就导致了对自身初值敏感、容易陷入局部最优等缺陷。为了克服上述缺陷,使用粒子群算法对模糊c-均值聚类算法进行优化,通过对惯性权重的设置一个容易取得全局最优的值,以取得基本粒子对搜索空间的扩展,从而使整个算法具有较强的全局寻优能力。通过对仿真实验结果的分析,该算法相对传统的模糊c-均值聚类算法在入侵检测中具有更高的入侵检测率,同时具有较低的误警率,具有一定的实用价值。更多还原

【Abstract】 With the rapid development of computer network technology, it’s application domian expanded increasingly,human life are becoming increasingly dependent on computer network. The problem of network security became a concern hotspot.Intrusion detection technology was an important dynamic security technology,it can improve the security of the system protection level with static firewall technology. This paper introduced systematically the concept development, firewall relationship, basic principle, working mode, classification and development trend of the intrusion detection.Clustering analysis is an important technology in data mining technology and is an unsupervised learning.According to the related features of data set, it could separate the data set into a series of meaningful data subsets without prior knowledge and artificial guidance. This paper introduced the concept, common similarity distance functions, common similarity coefficient, and basic steps about clustering analysis, and analyzed that principle, algorithm,process,advantages and disadvantages of the c-means clustering.This paper presented a Fuzzy c-means clustering algorithm based on particle swarm optimization and the algorithm was applied to intrusion detection. Fuzzy c-means clustering algorithm is a kind of clustering algorithm based on the objective function, there wew some local minimum points in the objective function, each iteration of algorithm was operated according to reduced direction of the target function, These led to some defects, which initial sensitive, easy to getting into the local optimality. In order to overcome the defects, Fuzzy c-means clustering was optimized based on particle swarm algorithm. It set the larger inertia value to expand the basic particles search space, the algorithm has strong global search optimization ability.Experiment results showed the algorithm has higher accuracy of intrusion detection and lower false alarm rate than traditional fuzzy c-means clustering,it Has certain practical value.更多还原