A Clustering Method for Anomaly Intrusion Detection
Xun Gong · Computers & Security · 2013
Euclidean distance is used to calculate similarity between samples by traditional K-means clustering algorithm.The importance of different attributes is not considered.As a result,the sample’s distance measurement is not accurate;the quality of clustering is bad.To solve the problem,an improved k-means clustering algorithm was proposed.By calculating every attribute’s information gain ratio with respect to clustering class,take the information gain ratio as weight to calculate Euclidean distance.In this way,the attributes which more contributing to classify get more weight,the measurement between samples is more accurate.By experiments on classic UCI KDD CUP intrusion detection dataset,the result shows that,comparing with traditional k-means intrusion detection method,the method proposed by this paper can effectively improve detection accuracy.