Zhong-Yang Xiong

Distributed intrusion detection based on clustering

The research on distributed intrusion detection system (DIDS) is a rapidly growing area of interest because the existence of centralized intrusion detection system (IDS) techniques is increasingly unable to protect the global distributed information infrastructure. Distributed analysis employed by agent-based DIDS is an accepted fabulous method. Clustering-based intrusion detection technique overcomes the drawbacks of relying on labeled training data which most current anomaly-based intrusion detection depend on. Clustering-based DIDS technique according to the advantages of two techniques is presented. For effectively choosing the attacks, twice clustering is employed: the first clustering is to choose the candidate anomalies at agent IDS and the second clustering is to choose the true attack at central IDS. At last, through experiment on the KDD CUP 1999 data records of network connections verified that the methods put forward is better.

The Study of Parallel K-Means Algorithm

Clustering analysis plays an important role in scientific research and commercial application. K-means algorithm is a widely used partition method in clustering. As the datasets scale increases rapidly, it is difficult to use k-means to deal with massive amount of data. A parallel strategy is incorporated into clustering method and a parallel k-means algorithm is proposed. For enhancing the efficiency of parallel k-means, dynamic load balance is introduced. Data parallel strategy and master/slave model are adopted. The experiments demonstrate that the parallel K-means has higher efficiency and universal use

An unsupervised anomaly intrusion detection algorithm based on swarm intelligence

An approach to network intrusion detection is investigated, based on swarm intelligence. The basic idea of the method is to produce the cluster by swarm intelligence-based clustering. With the classified data instances, anomaly data clusters can be easily identified by normal cluster ratio. And then the identified cluster can be used in real data detection. In the traditional clustering-based intrusion detection algorithms, clustering using a simple distance-based metric and detection based on the centers of clusters, which generally degrade detection accuracy and efficiency. Our approach based on swarm intelligence can settle these problems effectively. The experiment result shows that our approach can detect unknown intrusions efficiently in the real network connections.

An efficient clustering algorithm

Clustering analysis plays an important role in scientific research and commercial application. K-means algorithm is a widely used partition method in clustering. As the datasets scale increases rapidly, it is difficult to use K-means and deal with massive data. An improved K-means algorithm is presented. It can avoid getting into locally optimal solution in some degree, and reduce the probability of dividing one big cluster into two or more ones owing to the adoption of squared-error criterion. The experiments demonstrate that the improved K-means is more stable and more accurate.

Network Anomaly Detection Based on DSOM and ACO Clustering

An approach to network anomaly detection is investigated, based on dynamic self-organizing maps (DSOM) and ant colony optimization (ACO) clustering. The basic idea of the method is to produce the cluster by DSOM and ACO. With the classified data instances, anomaly data clusters can be easily identified by normal cluster ratio. And then the identified cluster can be used in real data detection. In the traditional clustering-based intrusion detection algorithms, clustering using a simple distance-based metric and detection based on the centers of clusters, which generally degrade detection accuracy and efficiency. Our approach based on DSOM and ACO clustering can settle these problems effectively. The experiment results show that our approach can detect unknown intrusions efficiently in the real network connections.

Density core-based clustering algorithm with dynamic scanning radius

Abstract Clustering analysis has been widely used in many fields such as image segmentation, pattern recognition, data analysis, market researches and so on. However, the distribution patterns of clusters are natural and complex in many research areas. In other words, most real data sets are non-spherical or non-elliptical clusters. For example, face images and hand-writing digital images are distributed in manifolds and some biological data sets are distributed in hyper-rectangles. Therefore, it is a great challenge to detect clusters of arbitrary shapes in multi-density datasets. Most of previous clustering algorithms cannot be applied to complex patterns with large variations in density because they only find hyper-elliptical and hyper-spherical clusters through centroid-based clustering approaches or fixed global parameters. This paper presents DCNaN, a clustering algorithm based on the density core and the natural neighbor to recognize complex patterns with large variations in density. Density cores can roughly retain the shape of clusters and natural neighbors are introduced to find dynamic scanning radiuses rather than fixed global parameters. The results of our experiments show that compared to state-of-the-art clustering techniques, our algorithm achieves better clustering quality, accuracy and efficiency, especially in recognizing extremely complex patterns with large variations in density.

A Parallel Classification Algorithm Based on Hybrid Genetic Algorithm

In this paper, a parallel classification algorithm based on an improved hybrid genetic algorithm (PC-HGA) is presented. It attempts to solve the problems of lower classification rule quality, more redundancy rules after optimizing generations and classification accuracy using the traditional genetic algorithm in classification mining. A rule extraction approach to improve the classification accuracy and condense the classification rule set is also given. In order to further improve the efficiency of classification mining, the master-slave parallel computing mode is adopted in PC-HGA. Experiments of PC-HGA algorithm are carried out on two benchmark datasets: iris and dermatology from UCI machine-learning repository. The experimental results show that PC-HGA has good speedup performance and can discover a set of the succinct, efficient and understandable classification rules

Intrusion detection based on dynamic self-organizing map neural network clustering

An approach to network intrusion detection is investigated, based on dynamic self-organizing maps (DSOM) neural network clustering. The basic idea of the method is to produce the cluster by DSOM. With the classified data instances, anomaly data clusters can be easily identified by normal cluster ratio. And then the identified cluster can be used in real data detection. In the traditional clustering-based intrusion detection algorithms, clustering using a simple distance-based metric and detection based on the centers of clusters, which generally degrade detection accuracy and efficiency. Our approach based on DSOM clustering can settle these problems effectively. The experiment result shows that our approach can detect unknown intrusions efficiently in the real network connections.

Intrusion Detection Classifier Based on Dynamic SOM and Swarm Intelligence Clustering

A clustering analysis model based on dynamic self-organizing maps (DSOM) and swarm intelligence (SI) is systematically proposed for intrusion detection system. The basic idea of the model is to produce the cluster by DSOM and SI. With the classified data instances, the detection classifier can be established. And then the detection classifier can be used in real intrusion detection. Experimental results show that our detection classifier maintained a higher performance than SVM, LGP, DT and K-NN.

A Novel Method of Intrusion Detection Based on Artificial Immune System

This paper presents a novel method of intrusion detection based on artificial immune system. Adopting the constraint-based detectors and any-r intervals matching rule, a novel solution is presented to encode the antibody-antigen. Some immune related concepts are introduced. In order to accelerate the accessing of the normal IP packets, the self-pattern class is proposed. Using the data sets of KDD CUP1999, the experiment results show that the proposed method can achieve a faster running speed and better detecting rates. It also can adapt to dynamically changing environments