提出了一种基于改进的CURE聚类算法的无监督异常检测方法。在保证原有CURE聚类算法性能不变的条件下,通过对其进行合理的改进获得更加理想的簇,也为建立正常行为模型提供了更加纯净的正常行为数据。在建模过程中,提出了一种新的基于超矩形的正常行为建模算法,该算法有助于迅速、准确地检测出入侵行为。实验采用KDDcup99数据,实验结果表明该方法能够有效地检测网络数据中的已知和未知入侵行为。
A novel unsupervised anomaly detection method based on improved CURE clustering algorithm was presented.By improving this algorithm,the better clusters could be obtained and the performance of the algorithm wasn’t changed.These clusters offered the more purely normal data to build normal model.A novel hyper-rectangle-based modeling algorithm was used and it helped to detect intrusions quickly and accurately.Using KDD CUP99 data sets,the experiment result shows that this method can detect known intrusions and unknown intrusions efficiently in the network connections.