张 珍,万世昌

摘 要:为了进一步提高网络入侵检测技术的检测率,降低误报率和漏报率。针对普通聚类算法存在的聚类结果对随机选取初始聚类中心敏感、分类结果不稳定,从而造成的检测率低、漏报和误报率高的特点。提出一种基于动态聚类算法的网络入侵检测模型,实验结果表明通过在K-均值聚类算法的基础上增加动态迭代调整聚类中心,使聚类结果更稳定更准确。与K-均值聚类等算法相比提高了网络入侵检测的性能,从而表明该算法的可行性、有效性。

关键词:聚类;聚类中心;距离;迭代;入侵检测

中图分类号:TP393文献标识码:A

文章编号:1004-373X(2009)20-085-03

Application of Dynamic Clustering Algorithm in Network Intrusion Detection

ZHANG Zhen,WANG Shichang

(School of Computer Science,Shaanxi Normal University,Xi′an,710062,China)

Abstract:In order to improve the detection rate,lower false alarm rate and missing rate,further.A network intrusion detection model that combines a dynamic clustering algorithm and intrusion detection technology is proposed.The general clustering algorithm is sensitive of the initial cluster center using,and it can make the classification results of instability,resulting in the detection rate is low,and failing to report the characteristics of a high false alarm rate.A model of network intrusion detection based on dynamic clustering algorithm is introduced.Experimental results show that the dynamic clustering results are more stable and more accurate by adding dynamic iteration to adjust the basis of cluster center.To a certain extent,the performance of network intrusion detection is improved,the feasibility and effectiveness of the algorithm are demonstrated.

Keywords:clustering;cluster center;distance;iterative;intrusion detection

0 引 言

随着网络技术的快速发展,网络规模随之不断扩大,计算机已从独立的主机发展到互联的、开放式的系统,这为人们的信息交流和资源共享带来了极大的便利,但同时网络环境也变得越来越复杂[1]。随着Internet大范围的开放以及金融领域的接入,越来越多的系统遭到入侵攻击的威胁,网络安全也面临越来越严重的威胁,这些威胁大多是通过挖掘操作系统和应用服务程序的弱点来实现的。

过去,防范网络安全攻击最常用的方法是使用防火墙,但防火墙技术有它自身的局限性[2]。防火墙本身会有各种漏洞和后门、不能阻止内部攻击、一般不能提供实时的入侵检测等,在这种情况下,单纯以防火墙技术来防范网络攻击已暴露出明显的不足和局限。

入侵检测系统[3,4]是在防火墙和信息加密等网络安全保障技术之后发展起来的新一代网络安全防护系统。……