Research On Some Fuzzy C Means Clustering Algorithm And Its Application In IDS

Intrusion detection technology as a proactive and defensive security technology has become animportant research topic. Cluster analysis as an unsupervised learning technique can directlyestablish intrusion detection model in the unlabeled data. Fuzzy cluster analysis technique expressesthe uncertainty degree of the generic sample, makes the clustering results more realistic andimproves the system’s ability to detect unknown intrusion, thus fuzzy clustering technique becomesthe mainstream of cluster analysis.In this paper, fuzzy C means (FCM) clustering algorithm and its improved algorithm forintrusion were studied and analyzed. The main work is as follows:1、 An improved FCM algorithm based on the optimization of initial points and membershipfunction (DMFCM) is proposed. The method uses density method to compute and select clustercenters rather than random selection, it avoids falling into local optimal solution; In addition, themethod optimizes membership function, reduces the impact of isolated points. Experimental resultsshow that the speed and the iterations of the DMFCM algorithm significantly reduced, the rate ofintrusion detection is greatly accelerate and the detection rate is slightly increased.2、 A kernel fuzzy C means clustering algorithm based on distance correction (KFCM_d) isproposed. The method takes into account the distance change between data points and data pointsbased on the Euclidean distance compared with fuzzy kernel C means clustering algorithm (KFCM),corrects Euclidean distance. Experimental results show that the cluster effect of the method is goodto the nonlinear separable data, and the detection rate is improved, false alarm rate is reduced.3、 A kernel fuzzy C means clustering algorithm based on noise class and distance correction(NKFCM_d) is proposed. The method takes into account the impact of noise combined withKFCM_d algorithm, makes the algorithm has good anti noise performance. Experimental resultsshow that the algorithm has good clustering effect to the nonlinear separable data with noise, themethod greatly improves the detection rate of intrusion detection, reduces the false alarm rate.