| With the vigorous development of the information technology industry,network security issues have followed.Nowadays,the network security defense technologies such as firewalls and encryption technologies cannot adapt to dynamic and complex network environments.Therefore,intrusion detection technology comes into being.In the context of the Internet,people's desire for data value has given birth to data mining technology.Applying data mining technology to the field of intrusion detection can analyze normal behavior data and abnormal behavior data,which can effectively improve the performance of intrusion detection.K-means,as a classic cluster analysis algorithm in data mining,is widely used in intrusion detection.However,due to the difficulty of determining the number of clusters and the initial cluster center point,the intrusion detection effect is not good.To this end,an intrusion detection method based on improved K-means is proposed in this paper.The optimal number of clusters is obtained by the validity index,and considering the different influences of each dimension on the clustering,features is weighted.Three-way decision clustering method is introduced to improve the clustering effect.The main research contents in this article are as follows:(1)Summarize the basic concepts of intrusion detection.Analyze and explain the principles of intrusion detection system,including the workflow,its basic composition and classification.On this basis,the existing problems and future development trends of intrusion detection systems are discussed.(2)Optimize the cluster analysis algorithm K-means combining the characteristics of network data in intrusion detection.Considering that different features of network data have different effects on clustering,the features are weighted;the k-value validity index is used to determine the number of clusters,and the initial clustering center point is optimized to make the final clustering algorithm more stable.Combining the ideas of three-way decision,the uncertain objects in the cluster are divided into the boundary domain,and the data in the boundary domain is delayed,and the secondary clustering is convenient to improve the accuracy of the clustering.The validity verification experiment for algorithm is carried out by selecting datasets in UCI.The result of the experiments shows that the improved algorithm can effectively improve the quality of clustering.(3)Design a hybrid intrusion detection model based on improved K-means algorithm,and experiments of the anomaly detection module are performed.The result of the experiments shows that compared with the intrusion detection algorithm based on the traditional K-means,intrusion detection algorithm based on the improved K-means has a higher detection rate and a lower false detection rate. |
