通过研究基于距离的孤立点发现算法(Cell-Based),指出其存在的问题,提出了一种基于核映射空间距离的入侵检测算法.该算法通过检测孤立点的方法进行入侵检测,首先将样本通过核函数映射到高维特征空间,重新定义特征空间中的数据点之间的距离.然后经过初始聚类算法确定聚类数目和初始类中心,再通过迭代优化目标函数来实现数据点的再聚类,最终得到聚类中心,超出聚类中心点半径r外的点即为孤立点.试验结果表明,该算法能有效突出样本之间的差异,克服传统基于距离的孤立点发现算法易随参数变化而需调整单元结构的缺点,且具有更准确的检测率和较快的收敛速度.
An algorithm of finding distance-based outlier (Cell-Based) was studied. Its disadvantages were pointed out. An algorithm of intrusion detection based on kernel mapping was proposed, which could detect intrusion by finding outliers. The data point was mapped from the original space to a high-dimensional feature kernel space by kernel function, and the distance between the data points was redefined. After initial clustering processing, the number of clusters and the original cluster centers were obtained. Through iterative processing for modified objective function, reclustering of data points was realized. Those points which were out of the cluster centers' radius were the outliers. Experiments showed that the data points are more separable in this algorithm. The algorithm can overcome the faults of traditional Cell-Based algorithm, which need to be recomputed from the scratch for every change of the parameters. It also has higher detection rate at higher convergence speed.