Research on Abnormal Detection Based on Improved Combination of K - means and SVDD

2017 International Conference on Power and Energy Engineering

Hao, Xiaohong^1 ; Zhang, Xiaofeng^2

School of Electrical Engineering and Information Engineering, Lanzhou University of Technology, Lanzhou

730050, China^1

School of Computer and Communication, Lanzhou University of Technology, Lanzhou

730050, China^2

关键词: Abnormal detection;    Anomaly-detection algorithms;    False alarm rate;    High detection rate;    Improved K-Means algorithm;    Network intrusion detection;    Security protection;    Training sample;   

Others  :  https://iopscience.iop.org/article/10.1088/1755-1315/114/1/012014/pdf
DOI  :  10.1088/1755-1315/114/1/012014

来源: IOP

【 摘 要 】

In order to improve the efficiency of network intrusion detection and reduce the false alarm rate, this paper proposes an anomaly detection algorithm based on improved K-means and SVDD. The algorithm first uses the improved K-means algorithm to cluster the training samples of each class, so that each class is independent and compact in class; Then, according to the training samples, the SVDD algorithm is used to construct the minimum superspheres. The subordinate relationship of the samples is determined by calculating the distance of the minimum superspheres constructed by SVDD. If the test sample is less than the center of the hypersphere, the test sample belongs to this class, otherwise it does not belong to this class, after several comparisons, the final test of the effective detection of the test sample.In this paper, we use KDD CUP99 data set to simulate the proposed anomaly detection algorithm. The results show that the algorithm has high detection rate and low false alarm rate, which is an effective network security protection method.