Download - Academy Publisher

ISBN 978-952-5726-09-1 (Print)
Proceedings of the Second International Symposium on Networking and Network Security (ISNNS ’10)
Jinggangshan, P. R. China, 2-4, April. 2010, pp. 089-092
An Anomaly Detection Method Based on Fuzzy
C-means Clustering Algorithm
Linquan Xie 1 , Ying Wang 1,2 , Liping Chen 2 , and Guangxue Yue 1,2,3
1
Jiangxi University of Science and Technology, Ganzhou, China
2
Jiaxing University, Jiaxing, China
3 Guangdong University of Business Studies ,GuangZhou, China
Email: {lq_xie@163.com , wy363100506@sina.com}
Abstract—Anomaly detection based on network flow is the
basis of the monitoring and response application of
anomaly, it is also the important content in the fields of
network and security management. In this paper, the fuzzy
C-means clustering (FCM) algorithm was applied to detect
abnormality which based on network flow. For the
problems of the FCM, for example, it needs to preset a
number of clusters and initialize sensitively, and easily fall
into local optimum, the paper introduced the method
combined with the average information entropy, support
vector machine and fuzzy genetic algorithm etc.. These
hybrid algorithms can solve the mentioned problems and
classify more accurately. Finally based on the current
development and the discussion of the research, it
summarized the trends of the network flow anomaly
detection in the paper.
Index Terms—network flow, anomaly detection, intrusion
detection, anomaly analysis
I. INTRODUCTION
As the rapid expansion and the growing popularity of
the Internet, more and more information has been
transmitted and stored through the network. Cognizing
and studying the behavioral characteristics of the Internet
users has gradually attracted people's interest, and it also
used to cognize, manage, optimize various kinds of the
network resources, and is an important basis of the
network planning and design. However, compared with
the development of the network application types, the
improvement of the network management technology
lags behind the development of the application. How to
provide a safe, reliable and efficient service environment
for the vast number of the Internet users, it needs to be
resolved to the network management. Network flow
analysis comes into being for resolving these issues; we
can indirectly get hold of the statistical behavior of the
network by statistical analysis of the network flow. It can
enhance the manager of the network and security to
troubleshoot the network anomaly, maintaining the
normal network and to ensure the network security. At
present, for the network flow anomaly detection, there
has conducted extensive research, but the detection
accuracy has been far from desirable. Nevertheless, the
anomaly detection plays an irreplaceable role in
discovering unknown anomaly network intrusion
detection and network failure detection, etc.
II. METHODS OF THE ANOMALY DETECTION BASED ON
THE NETWORK FLOW
For the methods of the network flow anomaly
detection, there has been summarized of the related
research work in recent years, including the following
methods: the research method based on the
features/behavior, the anomaly detection based on the
statistics, the method based on the machine learning and
the method based on the data mining, etc.. We can find
the latter three methods of anomaly detection construct
models on normal behaviors, it compares with the
normal model to detect anomalies, thus it can effectively
find out the known and unknown attacks. With the
continuous research of intrusion detection, people obtain
plentiful and substantial results, at the same time, people
come to realize the pervasive problems of intrusion
detection, such as the rate of detection can not meet the
requirements of the modern high-speed network
communications, a higher rate of false alarm and missing
report in intrusion detection system (IDS), the IDS lacks
of active defense and the interaction is not enough
among the other network security devices. To solve the
above problems, the research on intrusion detection
which is distributed, intelligent and comprehensive of
development becomes a matter of course.
III. ANOMALY DETECTION OF NETWORK FLOW BASED
ON FUZZY C-MEANS CLUSTERING (FCM) ALGORITHM
How to provide a safe, reliable and efficient service
environment for the vast number of the Internet users, it
needs to be resolved for the network management. With
the rapid development of network technology and
continuous improvement for invasion of technology, the
ways of new attacks emerge in endlessly, in order to
detect and defense the unknown attacks, the intelligent
methods are the focus of intrusion detection and have
been widely used, such as data mining, neural networks,
support vector machine, intelligent agent and etc..
Cluster analysis is used to discover the hidden patterns
in the instance data and used to detect the meaningful
characteristics in intrusion. How to accurately determine
the intruder or the intrusion is the research topics of
anomaly intrusion, while there are many algorithms for
application of anomaly detection, among them, fuzzy
C-means clustering (FCM) algorithm becomes a hot
© 2010 ACADEMY PUBLISHER
AP-PROC-CS-10CN006
89