基于近邻传播聚类的离群检测算法在入侵检测中的应用研究

发布时间：2018-05-09 14:24

本文选题：离群检测 + 近邻传播　；参考：《合肥工业大学》2017年硕士论文

【摘要】：近年来,数据挖掘中的许多方向都取得了不小的突破,在入侵检测领域也取得了不小的成果。但是在大多数研究的算法仅仅是针对数据集做一般模式的研究,然而在某些时候看来一些与数据集中大多数数据模式和行为不一致的数据点,也存在着非常重要的研究价值,这些点被称为离群点,由少量离群点组成的簇被称为离群簇。在数据挖掘中,使用某些算法将数据集中这些离群点或者离群簇检测出来的方法叫做离群检测。在网络环境中,网络入侵行为通常是网络行为中比例非常小的一部分行为,并且这部分行为会对网络环境带来一定的危害而且该行为本身就有别于正常行为,所以可以说网络入侵也属于离群行为。因此,这种特性为离群检测应用到入侵检测中提供了理论上的可行性。本文主要研究了基于近邻传播聚类的离群检测算法在入侵检测中的应用,详细介绍与分析国内外常用的离群检测算法,并对近邻传播算法做了详细的介绍;证明了该算法应用于离群检测的可行性,提出了基于近邻传播聚类的离群检测算法;并设计了基于离群检测的入侵检测算法模型与流程,通过AP算法先对数据集进行聚类然后进行聚类划分并计算离群指数,挖掘出入侵行为。通过一些列实验,验证了本文提出算法的有效性。本文的主要工作如下:(1)深入的研究了离群检测技术,分析了离群检测技术的现状,详细的阐述了离群检测技术的各种方法,并分析了这些方法的优缺点。(2)详细的介绍了近邻传播聚类算法,针对近邻传播算法的特点以及离群检测的特性与环境,验证了近邻传播算法应用于离群检测的可行性,提出了基于近邻传播聚类的离群检测算法。(3)深入的研究了入侵检测相关技术,并针对基于离群检测的入侵检测提出了相对应的算法模型与流程。(4)设计了基于近邻传播聚类的离群检测算法应用于入侵检测的实验方案,对网络入侵检测数据集KDD CUP 99进行了研究分析,并将算法与数据集用于实验,验证算法的效果。本文提出的ODAP算法应用于入侵检测环境中,并根据实验的准确率等指标进行评估。实验表明,基于近邻传播聚类的离群检测算法在入侵检测中有较好的效果。
[Abstract]:In recent years, great breakthroughs have been made in many fields of data mining, and great achievements have been made in the field of intrusion detection. However, in most researches, the algorithms only focus on the general schema of the data set. However, in some cases, some data points that are inconsistent with most of the data patterns and behaviors in the data set also have very important research value. These points are called outliers, and clusters composed of a few outliers are called outliers. In data mining, using some algorithms to detect outliers or outliers in data sets is called outlier detection. In the network environment, the network intrusion behavior is usually a very small part of the network behavior, and this part of the behavior will bring some harm to the network environment and the behavior itself is different from the normal behavior. So it can be said that network intrusion also belongs to outlier behavior. Therefore, this feature provides a theoretical feasibility for outlier detection in intrusion detection. This paper mainly studies the application of outlier detection algorithm based on nearest neighbor propagation clustering in intrusion detection, introduces and analyzes the common outlier detection algorithms at home and abroad in detail, and introduces the nearest neighbor propagation algorithm in detail. The feasibility of applying this algorithm to outlier detection is proved, and an outlier detection algorithm based on nearest neighbor propagation clustering is proposed, and an intrusion detection algorithm model and flow chart based on outlier detection are designed. First, the data set is clustered by AP algorithm, then the outlier index is calculated and the intrusion behavior is mined. The validity of the proposed algorithm is verified by some column experiments. The main work of this paper is as follows: (1) the outlier detection technology is deeply studied, the current situation of outlier detection technology is analyzed, and the various methods of outlier detection technology are described in detail. The advantages and disadvantages of these methods are analyzed. (2) the nearest neighbor propagation clustering algorithm is introduced in detail. According to the characteristics of the nearest neighbor propagation algorithm and the characteristics and environment of outlier detection, the feasibility of applying the nearest neighbor propagation algorithm to outlier detection is verified. An outlier detection algorithm based on nearest neighbor propagation clustering is proposed. Based on outlier detection, the corresponding algorithm model and flow chart are proposed. An experimental scheme of outlier detection based on nearest neighbor propagation clustering is designed. The network intrusion detection data set KDD CUP 99 is studied and analyzed, and the algorithm and data set are used in experiments to verify the effect of the algorithm. The ODAP algorithm proposed in this paper is applied to the intrusion detection environment and is evaluated according to the experimental accuracy. Experiments show that the outlier detection algorithm based on nearest neighbor propagation clustering is effective in intrusion detection.
【学位授予单位】：合肥工业大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP311.13;TP393.08

【相似文献】