文档介绍：第 34卷第 2期计算机工程 2008年 1月
VoL34 January2008
· 安全技术· 文章编号:i000--3428(200j 2二—面丽————i 丽
基于划分和凝聚层次聚类的无监督异常检测
李娜,钟诚
(广西大学计算机与电子信息学院,南宁 530004)
摘要:将信息熵理论应用于入侵检测的聚类问题,给出在混合属性条件下数据之间距离、数据与簇之间距离、簇与簇之间距离的定义,
以整体相似度的聚类质量评价标准作为聚类合并的策略,提出了一种基于划分和凝聚层次聚类的无监督的异常检测算法。算法分析和实验
结果表明,该算法具有较好的检测性能并能有效检测出未知入侵行为。
关健阅:入侵检测;划分聚类;凝聚层次聚类;信息熵
UnsupervisedAnomaly Detection Based 0n Partition and
AgglomerativeHierarchical Clustering
LINa,ZHONG Cheng
(School puter(Schoolandof Information,GuangxiElectronics and University,Nanning 530004)
[Abstractl Information entropy theory is applied to the clustering problem for intrusion detection,and the distances for mixed attributes between mixedattributes for distances detection,andthe intrusion problemfor clustering the to applied is theory [Abstractlentropy Information
two dataitems,data andclusters,and twoclusters are applying overall similarityto evaluate the cluster quality for merging clusters , all
unsupervised anomaly detection algorithm based on partition and agglomerative hierarchical clustering,is presented
. The algorithm analysis and
experimental showresults algorithmthisthat obtains good detectionperformance and can detectefficiently the new unknown intrusions.
[Key words]intrusion detection;partition clustering;agglomerative hierarchical clustering;information entropy entropy cl