Research Of Intrusion Detection Based On GT-KM Algorithm

With the continuous developments of science and technology,information industry experienced a the rapid growth and its applications is expanding gradually.Simultaneously,the network attacks and damages problems are also more and more apparently so that more attentions needed to be taken urgently in information security technology.And all knowledge of information security technology is in relation to the intrusion detection technology intimately in the past few decades.Data mining techniques had been applied in intrusion detection.Owing to this the relevant characteristic attributes and security systems can be extracted that we need.Then classified these characteristic attributes of security events in convenient to the subsequent indentification work.a new GT-KM algorithm was employed that Combine growing tree algorithm and K-means algorithm in intrusion detection.And the main contexts as follow:(1)To solve the problem that insufficient sensitivity of the initial center and weakness of global search capability in the initial center selection of K-means algorithm.A GT-KM algorithm is a hybrid clustering algorithm which combine growing tree algorithm and K-means was used.To avoid the excessive dependence of the original clustering algorithm we searching the best consequence of the clustering by superior code style and global searching in growing tree algorithm.It reveals that the convergence rate,clustering qualities and stability are in good condition by compare the UCI standard databases.(2)GT-KM has been applied to intrusion detection system.It turned out that GT-KM algorithm clustering algorithm avoided some inevitable problems of the selection of initial cluster centers directly contrast to the traditional K-means algorithm.Based on the experiments of KDD CUP99 data.We also investigated other algorithms to ensure the effectiveness of GT-KM algorithm in intrusion detection system.It demonstrates that GT-KM algorithm is a better algorithm to dispose of the attacking of networks in stability and utility of the improvement of abnormal detections.