基于半监督聚类的免疫入侵检测算法研究

发布时间：2018-04-25 20:14

本文选题：半监督 + 聚类　；参考：《计算机应用与软件》2013年02期

【摘要】：传统的基于免疫的入侵检测系统需要足够的标记数据才能够生成具有良好泛化性能的抗体,而网络环境中获得充足的标记数据是困难的。为克服这一难题,对无监督聚类技术及免疫方法进行深入研究,并将二者结合起来,提出一种半监督的免疫入侵检测算法SCIID(Semi-supervised cluster based Immune Intrusion Detection)。在抗体产生阶段通过对自我样本进行聚类,大大缩短了阴性选择的时间;在入侵检测阶段采用聚类技术可快速获取未标记数据的类别,进而指导后续的学习过程,达到提高检测率的目的。仿真结果表明,该算法在仅有少量标记数据的情况下,可以获得大部分未标记数据的类别,而且能发现新的攻击类型,同等训练样例数目条件下检测率高于单纯基于免疫的方法。
[Abstract]:Traditional immune intrusion detection systems need enough tagging data to generate antibodies with good generalization performance. However, it is difficult to obtain sufficient labeled data in network environment. In order to overcome this problem, the unsupervised clustering technique and immune method are studied, and a semi-supervised immune intrusion detection algorithm (SCIID(Semi-supervised cluster based Immune Intrusion Detection) is proposed. In the stage of antibody generation, the time of negative selection is greatly shortened by clustering self-samples. In the stage of intrusion detection, the categories of unlabeled data can be quickly obtained by using clustering technology, and then the subsequent learning process can be guided. To achieve the purpose of improving the detection rate. The simulation results show that the algorithm can obtain most of the unlabeled data categories with only a small amount of tagged data, and can find new types of attacks. The detection rate under the condition of the same number of training samples is higher than that of the immune method alone.
【作者单位】：郑州大学体育学院现代教育技术中心;焦作师范高等专科学校计算机与信息工程学院;
【基金】：河南省自然科学基金项目(12B520056) 郑州大学体育学院青年基金项目(2011C3003)
【分类号】：TP393.08

【参考文献】