The Research Of Intrusion Detection Based On Clustering Analysis

With the development of the intrusion detection technology, nowadays the research of intrusion detection is the hotspot in the field of network security. Intrusion analysis module of intrusion detection system is the core part of whole the system. There are a lot of scholars working on the intrusion analysis technology. The clustering analysis technology can mine rules from the vast amounts of network traffic data, and can identify intrusion event. It is widely used in the analysis of intrusion data. This t hesis mainly study the K-means, Fuzzy ART and Kohonen algorithm. Two kinds of improved algorithm are proposed based on the three algorithms. They are applied to the intrusion data mining. The following are the main contents of this thesis:(1) Extract experimental data from the KDD CUP99 dataset. KDD CUP99 dataset is a kind of standard dataset for intrusion detection, in this thesis, using principal component analysis to reduce the dimensions of the data in the KDD CUP99 dataset.(2) Put forward an improved K-means algorithm based on Fuzzy ART. Using Fuzzy ART algorithm to preliminary clustering to get an better initial clustering center and the number of the cluster, then put the output of Fuzzy ART to K-means clustering.(3) Optimize the weight adjustment method of Kohonen algorithm. Calculate the membership degree between the input vectors with the neurons in the winning area, and then update the weight of neurons accord to the membership degree.(4) Experiment Analysis. Use Fuzzy ART, K-means and improved algorithm to do the clustering experiment on two intrusion datasets to verify the advantage of the improved algorithm, and to do the similar experiments of Kohonen and I-Kohonen on the same two datasets.All contributions of this thesis are:(1) an impro ved K-means algorithm is proposed to optimize the clustering center of K- means algorithm;(2) an improved Kohonen algorithm is proposed to optimize the weight learning of Kohonen neural network. The two improved algorithms are applied to the intrusion data clustering analysis and have achieved satisfactory results.