Research and Implementation of an Anomaly Intrusion Detection System Model Based on Similarity Cluster Analysis
Wang Li · Mini-micro Systems · 2004
A method of anomaly intrustion detection is proposed based on similirity cluster analysis which is a means of data mining. In this paper data minging technology is applied into intrusion detection and one model is constructed. The procedure of intrusion detection includes first to collect the user activities, then analyze these data using similarity cluster to create user profile, at last judge whether user activity is abnormal. The algorithoms of user profiles constructing and anomaly intrusion detection based on similarity measurement are discussed in detail. An improved algorithm is given.