Download - Academy Publisher

higher probability and converge at a high speed. At the
same time, the algorithm considered the affinity of
immune response in order to overcome the phenomenon
of precocity. In the paper, it introduced the improved
FCM algorithm into the anomaly intrusion detection
V. THE IMPROVED INTRUSION DETECTION ALGOITHM
BASED ON FCM
How to improve the detection efficiency of IDS is the
emphasis for people to research constantly. We cluster
the data which is not only the numerical data but also is
character data. For example, the KDD Cup 1999 network
datasets, each connection instance contains 41 properties.
In 41 properties, there are 3 flag properties and 38
numerical properties, at present, most of the studies were
directed at the numerical properties of the sample data.
If we research the hybrid attributes of the sample data,
the distance can only used into the numerical data, so we
used a new method to solve the problem[7], we may
defined the distance between x , x and k as fallow:
( x x )
⎧ x ≠
=
ik
x
d
jk
ik
,
jk ⎨
1
⎩0 , ⑹
, xik
= x
jk
We supposed the object data has p numerical
attributes and q categorical attributes, and the distance
between the objects can be defined as fallow:
' '
( x , x ) d ( x , x ) + d ( x x )
i
j
n
i
i
d = , ⑺
' '
In (7), d
n
( xi
, x
j
),
i ≠ j
numerical attributes, and ( x x )
c
j
j
c
i
is the distance of the
d , is the distance of
the character attributes.
We can get the objective function of the hybrid attributes
datasets; it can change from (2), that is:
N
⎧
k p
m ' ' 2
J
m
( U,
C) = ∑∑ ⎨ uij
∑( xik
− x
jk
) +
i= 1 ⎩ j= 1 l=
1
i
k p+
q
⎫
m
λ ∑uij
∑d
c
( xik
, x
jk
) ⎬
⑻
j=
1 l=
p+
1 ⎭
In (8), weight λ is to balance the properties of hybrid
attributes datasets, and the value λ is determined by
the proportion of two kinds properties; m > 1 is the
fuzzy coefficient, it uses to control the blur length of U .
Supposed:
As
n
Ci
and
C
C
n
Ci
and
c
i
n
i
c
i
=
k p
m
'
∑uij
∑( xik
− x
jl
)
j= 1 l=
1
k p+
q
m
∑uij
∑ c
j=
1 l=
p+
1
j
' 2
⑼
( x , x )
= λ d
⑽
ik
c
Ci
are nonnegative, we can minimize
J m
U, C minimization, at
C to make the ( )
jk
j
the same time, we use the Lagrange multiplier method:
u
ij
( x , x )
−1
2
⎧
⎫
k
d
m
⎪ ⎡ i j ⎤ −1
⎪
= ⎨∑ ⎢ ⎥ ⎬ , ∀i
⎪ l=
1 ⎣ d( xi
, xl
) ⎦ ⎪
⎩
⎭
We can iterate the process with (9), (10) and (11),
as m > 1, the algorithm is convergent.
The improved intrusion detection algorithm based on
FCM, which summarized as fallows [3]:
Step1: initialize the membership matrix U with
random number between 0 and 1, and satisfy (1).
Step2: for the different attributes of data, respectively
n
use (9) and (10) to calculate the cluster centers, C
i
,
C , i = 1,
Lk.
c
i
Step3: use (11) to calculate the new membership
matrix U.
Step4: calculate the value function according to (8). If
it is smaller than a determined threshold or is smaller
than the change with the last value function, then it will
stop and output the clustering results. Otherwise, return
to Step2 to continue iterating.
We not only consider the numeric data, also
considering the character data, when we use the method
to research the sample data. It more comprehensively
analyzed the data to the clustering, not only helps to
reduce the rate of the false alarm and the rate of the
failing alarm, at the same time, combine the method with
the optimized algorithm of FCM; it can further enhance
the detection efficiency.
ACKNOWLEDGMENT
This work is supported by Economic Commence
Market Application Technology Foundation Grant by
2007gdecof004.
REFERENCES
[1] Theodolidis S. Pattern Recongnition[M]. Second Edition,
USA: Elsevier Science, 2003.
[2] Gao XB. Fuzzy Cluster Analysis and its Application[M].
XI’AN: Xidian University Press, 2004, 49–61.
[3] Yang DG. Research of The Network Intrusion Detection
Based on Fuzzy Clustering[J]. Computer Science, 2005,
32(1): 86–91.
[4] Song QK, Hao M. Improved Fuzzy C-means Clustering
Algorithm[J]. Journal Harbin University Science and
Technology. 2007, 12(4):8–10.
[5] Xiao LZ, Shao ZQ, Ma HH, Wang XY, Liu G. An
Algorithm for Automatic Clustering Number
Determination in Network Intrusion Detection[J]. Journal
of Software, 2008, 19(8):2140–2148.
[6] Xian JQ, Lang FH. Anomaly Detection Method Based on
CSA-Based Unsupervised Fuzzy Clustering Algorithm[J].
Journal of Beijing University of Posts and
Telecommunications, 2005, 28(4):103–106.
[7] Li J, Gao XB, Jiao LC. A GA-Based Clustering Algorithm
for Large Data Sets with Mixed Numerical and Categorical
Values[J]. Journal of Electronics & Information Technology,
2004, 26(8):1203–1209.
⑾
92