ISSN 1000-1239 CN 11-1777/TP

Journal of Computer Research and Development ›› 2015, Vol. 52 ›› Issue (3): 718-728.doi: 10.7544/issn1000-1239.2015.20130601

Previous Articles     Next Articles

Anomaly Intrusion Behavior Detection Based on Fuzzy Clustering and Features Selection

Tang Chenghua1,2, Liu Pengcheng1,2, Tang Shensheng3, Xie Yi4   

  1. 1(Guangxi Key Laboratory of Trusted Software, Guilin University of Electronic Technology, Guilin, Guangxi 541004); 2(Guangxi Experiment Center of Information Science, Guilin University of Electronic Technology, Guilin, Guangxi 541004); 3(Department of Engineering Technology, Missouri Western State University, Saint Joseph, Missouri, USA MO 64507); 4(School of Information Science and Technology, Sun Yat-sen University, Guangzhou 510275)
  • Online:2015-03-01

Abstract: The behaviors of network attack connection are always changeable and complex. Typical behavior mining methods, which always do using traditional clustering, do not fit in with constructing anomaly intrusion detection model. According to the characteristics of network attacks, the anomaly intrusion detection model based on fuzzy clustering and features selection are proposed. Firstly, the results that the fuzzy C-means clustering algorithm is sensitive to the initial cluster centers is improved using hierarchical clustering algorithm, the disadvantage that FCM is easy to fall into local optimum in the iteration is overcome using the global search ability of genetic algorithm, and they are combined into a AGFCM algorithm. Secondly, the feature attribute data sets of network attack connection are sorted through the information gain algorithm. The capacity of feature attributes is determined by using the Youden index to cut the data sets at the same time. Lastly, the anomaly intrusion detection model is built by using the attribute data sets dimensionality reduction and improved FCM clustering algorithm. Experimental results show that the anomaly intrusion detection model can effectively detect the vast majority of network attack types, which provides a feasible solution for solving the problems of false alarm rate and detection rate in anomaly intrusion detection model.

Key words: fuzzy clustering, hierarchical clustering, features selection, fuzzy C-means, anomaly detection

CLC Number: