Research On The Application Of Fuzzy C-means Algorithm In Intrusion Detection System

As the development of computer network, network plays an increasingly important role in our society. At the same time, the security problems of network have become more and more serious, which holds the development of network technique. The traditional security technique of network, such as Firewall, Security Router, Identity Authentication System, has not satisfied the need of network security. As an active important technique security of network, intrusion detection has become a measure. The research on intrusion detection very has become more and more hot.Traditionally,we used C-means method,clusters similar data instances together into clusters and distance metrics are used on clusters to determine what is an anomaly. But there is some disadvantages in this method,such as the results of the cluster is sensitiveto the data input sequence,furthermore,it is a local optimum algorithm. Farther research is done to deal with the problem above,and the corresponding solutions are given.The main works of this thesis are summarized as follows:Based on the research on the intrusion detection technology and intrusion method in common use, this thesis studies on the Intrusion Detection Systems based on clustering technology, especially on clustering analysis applying in the intrusion detection, and a solution of runtime anomaly Intrusion Detection System based on clustering technology is proposed.In connection record analysis, the fuzzy c-means algorithm is modified according to the circumstantialities in intrusion detection. This thesis analyses and studies the fuzzy C-means (FCM)algorithm, and applies it in the intrusion detection, then proposes a modified fuzzy C-means algorithm.On the basis of the modified FCM algorithm, this thesis introduces the genetic algorithm to the modified FCM algorithm so that it can eliminate the sensitivity to the initialization and obtain a better partition of a data set into c classes. Then it can be proved that this combined algorithm is available and feasible through the experiment results.