以KDDCUP99-10%网络入侵数据集作为数据流,提出一种混合属性数据流的两阶段入侵检测算法.通过增量聚类提取数据流的代表信息,根据提出的加权模糊簇特征对增量聚类结果做模糊聚类,簇数可动态改变.理论分析和实验结果表明,该算法可以有效检测数据流入侵.
This paper proposes a two-phase intrusion detection algorithm in mixed attributes data stream KDDCUP99-10% network intrusion data set. The algorithm gains the statistical information in data stream by the incremental clustering. Weighted fuzzy clustering is done based on the statistical information according to proposed weighted fuzzy cluster feature. The number of clusters for fuzzy clustering can change dynamically. Theoretical analysis and experimental results show the algorithm can detect the intrusion behaviors effectively.