Download - Academy Publisher

topic that because it is flexible division of sample data
sets and can detect invasion more objectively.
A. The Theory of FCM
Fuzzy clustering is a multi-technology for
classification of objective things, which construct fuzzy
resemblance according to the characteristics of the
objective things, the relatedness and the similarity.
Ref. [1] referred the method of fuzzy clustering
analysis that it can be divided into three categories:
1) The number of categories is indeterminate; it means
to cluster dynamically according to the different
requirements.
2) The number of categories is given; the target is to
find out the best way to classify the data. This method
cluster based on objective function and called fuzzy C
means (FCM) algorithm or fuzzy ISODATA clustering.
3) In the case of significant perturbation, it clusters
according to the fuzzy similarity matrix. This method is
called fuzzy clustering based on perturbation.
The theory of fuzzy C-means clustering (FCM) [2,3]:
Fuzzy C-means clustering is an algorithm based on the
division, and it is an improved algorithm based on
C-means, the C-means algorithm is rigid for data
partition, but FCM is flexible and fuzzy for partition.
According to the quadratic sum in minimum of the
specified grouping, FCM uses the membership to
determine each data instance; it divides a data instance
X = { X
i
X
i
∈ R( i =1,2,
L,
n)
} with n into k
categories ( 1 < K < N ), and calculates the cluster center
of each category, in order to make the non-similarity
value function minimum. The matrix of
classification, U = ( uij i = 1,2,
L n;
j = 1,2, L,
k)
,
where u
ij
indicated the membership of the data
instance belong to , and satisfied the following
conditions:
k
∑
j=
1
u
ij
= 1, ∀i
= 1, L,
n.
Use the FCM for fuzzy partition, so that each given
data instance can determine which categories belong to,
according to the membership between 0 and 1. The
elements of the matrix U get values between 0 and 1.
The value function defined as follows:
m
N k
m 2
( U,
C) ∑∑uij
d ij
( X i
C j
)
i= 1 j = 1
⑴
J = ,
⑵
J
m
can be seen as the quadratic sum of the distance
between the each data instance and the cluster center. In
(2), C = { C
j
C
j
∈ I, j = 1,2, L,
k}
, and C j
∈ I
indicate the cluster centers; X i
∈ I indicate the data
instance sets; u ij
mean the membership of the data
instance belong to the cluster center, their values are
U = is a matrix of n × k ,
u ij
between 0 and 1, { }
[ C1, C2 , L C k
]
{ c , c2 , }
C = , is a matrix of s × k ;
C =
1
L,
c k
, c
i
indicate the cluster center of
p
the fuzzy group; X ∈ R are the data instances;
( X C )
i
d
ij i
,
j
indicate the distance between the data
instance and the cluster center; m means the fuzzy
coefficient ( 1 ≤ m < ∞)
; k means the number of the
pre-categories, it determined by the initial clustering. We
can use the Lagrange multiplier method to obtain the
necessary condition of minimum for J :
c
u
ij
ij
= 1
k
2
( ) ( m−1
∑ ) dij
di
, ∀i
⑶
1
i=
1
m
m
⎛ m ⎞ ⎛
= ⎜∑uij
x
j
⎟ ⎜∑u
⎝ i=
1 ⎠ ⎝ i=
1
ij
m
⎞
⎟,
∀j
⎠
The parameter m in the above formulas is a scalar to
control the blur length of the classification matrixU , the
bigger m is, the more blurred it is. If m = 1, the algorithm
of FCM degenerates into hard C-means clustering (HCM)
algorithm. FCM clustering needs many times to iterate so
that the value function obtains the minimum.
B. FCM Used in Anomaly Detection
The intrusion detection algorithm based on FCM [3]:
From the above discussion we can see, the FCM
algorithm requires two parameters: the number of
clusters C and the parameter m. The number of clusters
can use the clustering number of initial clustering as C,
and C is less than the total number of cluster samples.
The detection optimization can follow these steps:
Step1: initialize the membership matrix U with
random number between 0 and 1, and satisfy the
n
formula∑uij
= 1,
∀j
= 1, L , n .
i=
1
n
⎛ m ⎞
Step2: use ci
= ⎜∑uij
x
j
⎟
⎝ i=
1 ⎠
cluster centersC i
, i = 1, L,
k .
n
∑
j=
1
u
2 ( m−
j )
m
ij
⑷
to calculate the
c ⎛ d
ij
⎞
Step3: use uij
= 1 ∑⎜
⎟ to calculate the
k = 1 d
⎝ kj ⎠
new membership matrix U.
Step4: calculate the value function according to
J
m
N k
m 2
( U C) = ∑∑uij
dij
( X
i
, C
j
)
, . If it is smaller
i= 1 j=
1
than a determined threshold or is smaller than the change
with the last value function, then it will stop and output
the clustering results. Otherwise, return to Step2 to
continue iterating.
The output of the algorithm is a fuzzy partition matrix
with N × K , the matrix indicate the membership of the
90