|
Intrusion Detection System is a new generation of security technology, following the traditional security such as data encryption, access control and firewall protection measures after as a proactive protection technology has become a research focus in recent years. Intrusion detection systems to gather information in a computer network or system, to analyze the collected information to discover whether there are signs of attack or breach of security policy behavior in the network or system, and thus to take measures against these attacks or acts, protect your computer safety. After nearly 30 years of development, the traditional intrusion detection system has a higher detection rate of known data, the low rate of false positives, but for the poor effects of unknown attacks. The sharp increase in the amount of data in recent years, of which there are a large number of data available, but also needs to be a change of useful knowledge, been widely used so that the data mining. Cluster analysis is an essential technology in the data mining technology, it is the purpose of the data gathered into different classes, different object class difference as large as possible, while the object is in the same class as consistent as possible. Therefore, by clustering to dense and sparse regions are processed separately, so as to discover new knowledge. Cluster analysis, fuzzy C-means algorithm is used widely, but it has a fatal flaw: the initial value is very sensitive, and easy to fall into local minimum. The genetic algorithm is a by simulating the natural evolutionary process, get to search for the optimal solution, and therefore gives the FCM algorithm and genetic algorithm-based clustering method is referred to as the FGA algorithm, which take into account the genetic algorithm global optimization ability and local search ability of FCM algorithm to achieve the clustering problem, so that is conducive to the improvement of the detection rate applied to intrusion detection, and effectively improve the rate of false positives. Since the the FGA algorithm running slower, further improvements. In the original algorithm, the operation of the improved algorithm, the most important thing is to allow the individual can contain empty class; another application of the incremental technology, the incremental computing center value and the value of the objective function, effectively improve the algorithm efficiency. In this paper, KDD CUP 99 data set of the given algorithm simulation experiments, after experimental verification FGA algorithm clustering effect is better than the FCM algorithm; improved the FGA algorithm due simplify operations and incremental computation than the original FGA algorithm convergence speed, especially when small input mutation probability, this advantage is more obvious. Experimental results show that the FGA algorithm has a broad application prospects in the field of intrusion detection.
|