An intrusion detection method based on density divergence clustering

Abstract

The application relates to the technical field of network security, in particular to an intrusion detection method based on density divergence clustering, which comprises the following steps: obtaining a data set for network intrusion detection, carrying out density divergence clustering, and obtaining attack data; wherein the density divergence clustering comprises the following steps: calculating the Euclidean distance between all feature data points in the data set two by two, and taking a preset percentage of all Euclidean distances as a cutoff distance; calculating the density of each feature data point according to the Euclidean distance and the cutoff distance; carrying out density divergence clustering on the feature data points according to the density, distributing the feature data points to corresponding clusters, and obtaining a clustering result containing several clusters; and constructing a judgment index through quartiles for the clustering result, judging and extracting an abnormal cluster, and obtaining the attack data. The scheme can more accurately identify abnormal behaviors under complex environments and has stronger anti-interference capability, so that network attacks can be effectively detected.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to an intrusion detection method based on density divergent clustering. Background Technology

[0002] With the rapid development of information technology, network security has become a critical issue in modern society. To protect network security, intrusion detection systems (IDS) have been researched for detecting and preventing various network attacks. However, existing intrusion detection methods in IDS are prone to false positives and false negatives when facing unknown attacks in complex environments. Therefore, researching new intrusion detection technologies targeting unknown attacks in complex environments has become an important topic in the current field of network security.

[0003] Existing intrusion detection methods include signature-based detection, anomaly-based detection, model-based detection, and clustering-based intrusion detection methods. Among them, clustering-based intrusion detection methods have significant advantages in handling unknown attacks and can effectively identify some unknown attacks. However, without human intervention, they often struggle to accurately distinguish between normal and abnormal data in high-dimensional and large-scale datasets.

[0004] Therefore, there is an urgent need for an intrusion detection method based on density divergent clustering, which can more accurately identify abnormal behavior in complex environments and has stronger anti-interference capabilities to effectively detect network attacks. Summary of the Invention

[0005] The present invention aims to provide an intrusion detection method based on density divergent clustering, which can more accurately identify abnormal behavior in complex environments and has stronger anti-interference capabilities to effectively detect network attacks.

[0006] This invention provides the following basic solution: an intrusion detection method based on density divergent clustering, comprising: Obtaining a dataset for network intrusion detection Density divergent clustering is performed to obtain attack data; Density divergent clustering includes: For dataset Calculate the Euclidean distance between all feature data points pairwise, and use the preset percentile of all Euclidean distances as the cutoff distance. ; Based on Euclidean distance and cutoff distance Calculate the density of each feature data point. ; According to density Density divergent clustering is performed on the feature data points to assign them to the corresponding clusters and obtain clustering results containing several clusters. Based on the clustering results, a judgment index is constructed using quartiles to identify and extract abnormal clusters, thereby obtaining attack data.

[0007] Furthermore, the acquisition of the network intrusion detection dataset ,include: Obtain feature data for network intrusion detection and form a dataset. ; For dataset Perform preprocessing to obtain the preprocessed network intrusion detection dataset. .

[0008] Furthermore, the characteristic data includes: network connection duration, protocol type, data traffic, service type, login attempts, and file access.

[0009] Furthermore, the preprocessing includes: standardization and dimensionality reduction; For dataset The feature data in the data are standardized. Composition of standardized feature data Data matrix ,in For the sample size, As the eigenvalues, principal component analysis is used to analyze the data matrix. Perform dimensionality reduction to obtain ; Output the dimensionality-reduced dataset As a preprocessing result.

[0010] Furthermore, the preset percentage is 5%.

[0011] Furthermore, the density The calculation process is as follows: ; in, Representing feature data points With feature data points The Euclidean distance between them This is an indicator function; it takes the value 1 if the condition is true and 0 if the condition is false.

[0012] Furthermore, the statement based on density Density divergent clustering is performed on the feature data points to obtain clustering results containing several clusters, including: S30301. Define the density gradient and feature data points. With feature data points The density gradient between them is: ; S30302, Define density-divergent neighbors: in, To preset the density gradient threshold, Indicates distance from feature data points Recent A set consisting of feature data points; S30303: Find the point with the highest density among the unassigned feature data points. Establish a new cluster ; S30304, Calculate density diverging neighbors And join New additions to recursive calculations The density of the feature data points diverges from the neighbors and all are added. ; S30305. Determine if there are still unassigned feature data points. If yes, execute S30303; otherwise, execute S30306. S30306. Output each cluster as the clustering result.

[0013] Furthermore, the aforementioned It is 0.1. It is 10.

[0014] Furthermore, the clustering results are analyzed using quartiles to construct a criterion for identifying and extracting anomalous clusters, thereby obtaining attack data, including: Calculate the array consisting of the number of all clusters interquartile interval : ; in, It is the first quartile. It is the third quartile; Determine if the number of feature data points in each cluster is less than If so, then the cluster is determined to be an anomalous cluster; where Adjustment coefficient The characteristic data in the abnormal cluster is used as attack data and output.

[0015] Furthermore, the aforementioned It is 1.5.

[0016] Beneficial Effects: This solution acquires a network intrusion detection dataset and performs density-divergent clustering to obtain attack data. Specifically, density-divergent clustering is performed by using Euclidean distance and truncation distance to obtain the density of each feature data point, and then performing density-divergent clustering to assign the feature data points to corresponding clusters, resulting in clustering results containing several clusters. The clusters formed by density-divergent clustering are distinguished by density; clusters formed by regions with higher density contain normal data, while clusters formed by regions with lower density or divergent clusters generally contain anomalous data. Therefore, based on the clustering results, anomalous clusters are identified and extracted, thereby obtaining attack data. The entire intrusion detection process requires no manual intervention; density-divergent clustering can adaptively diverge to identify anomalous data, thus determining attack data, and can identify unknown attacks with high accuracy even in complex environments. The density divergent clustering proposed in this scheme is applied to intrusion detection. Density divergent clustering can perform effective clustering without prior knowledge, enabling this scheme to more accurately identify abnormal behavior in complex environments. Its density-adaptive clustering method can adapt to data of arbitrary shapes, giving the scheme stronger anti-interference capabilities and better scalability, thus effectively detecting network attacks.

[0017] In summary, this solution can more accurately identify abnormal behavior in complex environments and has stronger anti-interference capabilities and better scalability to effectively detect network attacks. Attached Figure Description

[0018] Figure 1 This is a schematic flowchart of an embodiment of an intrusion detection method based on density divergent clustering according to the present invention; Figure 2 This is a schematic diagram illustrating the process of acquiring attack data in an embodiment of an intrusion detection method based on density divergent clustering according to the present invention. Figure 3 This is a schematic diagram of the density divergent clustering process in an embodiment of an intrusion detection method based on density divergent clustering according to the present invention. Detailed Implementation

[0019] The following detailed description illustrates the specific implementation method: Example 1 This embodiment is basically as shown in the appendix. Figure 1 As shown, an intrusion detection method based on density divergent clustering is provided, including: acquiring a dataset for network intrusion detection. Density divergent clustering is performed to obtain attack data; The specific process is as follows: S1. Obtain feature data for network intrusion detection to form a dataset. In this embodiment, the feature data includes: network connection duration, protocol type, data traffic, service type, login attempts, and file access.

[0020] S2, Dataset Perform preprocessing to obtain the preprocessed network intrusion detection dataset. ; Preprocessing includes standardization and dimensionality reduction; Specifically, it includes: S201, Regarding the dataset The feature data in the data are standardized to eliminate the dimensional differences between different features. The standardization calculation formula is as follows: ; in, It is the original feature data. It is the mean of the feature data. It is the standard deviation of the feature data; S202, Composition of standardized feature data Data matrix ,in For the sample size, The eigenvalues ​​are used to analyze the data matrix through principal component analysis (PCA). Perform dimensionality reduction to obtain Calculation formula: ; in, Depend on The first covariance matrix Composed of eigenvectors, Determined by the variance retention rate; S203, Output the dimensionality-reduced dataset As a preprocessing result.

[0021] S3, Dataset Perform density divergent clustering to obtain attack data; like Figure 2 As shown, the specific process is as follows: S301, Regarding the dataset Calculate the Euclidean distance between all pairwise feature data points, and take the 5th percentile of all Euclidean distances as the cutoff distance. ; S302. Calculate the density of each feature data point. : ; in, Representing feature data points With feature data points The Euclidean distance between them As an indicator function, it takes the value 1 if the condition is true and 0 if the condition is false. This formula makes the more points around a point, the denser the point becomes. S303, based on density Density divergent clustering is performed on the feature data points to obtain clustering results containing several clusters; like Figure 3 As shown, the specific process is as follows: S30301. Define the density gradient and feature data points. With feature data points The density gradient between them is: ; S30302, Define density-divergent neighbors: in, To preset the density gradient threshold, Indicates distance from feature data points Recent A set consisting of feature data points; where and Based on the requirements, this embodiment is configured as follows. , In other embodiments, such as when the dataset is extremely small and some points cannot find 10 neighbors, then... A smaller value can be taken; S30303: Find the point with the highest density among the unassigned feature data points. Establish a new cluster ; S30304, Calculate density diverging neighbors And join New additions to recursive calculations The density of the feature data points diverges from the neighbors and all are added. ; S30305. Determine if there are still unassigned feature data points. If yes, execute S30303; otherwise, execute S30306. This forms an adaptive loop that adapts to different environments, divides all feature data points, generates more accurate clustering results, and thus can more accurately identify attack data. S30306. Output each cluster as the clustering result.

[0022] S304. Based on the clustering results, construct a judgment index using quartiles, identify and extract abnormal clusters, and obtain attack data: The specific process is as follows: the array consisting of the total number of clusters is... ,calculate interquartile interval : ; in, It is the first quartile (25%). It is the third quartile (75%); Determine if the number of feature data points in each cluster is less than If so, then the cluster is determined to be an anomalous cluster; where The adjustment coefficient is set according to requirements; in this embodiment... This value is obtained through statistics and is the value that should typically be used to identify outliers under a normal distribution. The characteristic data in the abnormal cluster is used as attack data and output.

[0023] This solution can more accurately identify abnormal behavior in complex environments and has stronger anti-interference capabilities and better scalability to effectively detect network attacks.

[0024] The above descriptions are merely embodiments of the present invention. Commonly known structures and characteristics are not described in detail here. Those skilled in the art are aware of all common technical knowledge in the field prior to the application date or priority date, are aware of all existing technologies in that field, and have the ability to apply conventional experimental methods prior to that date. Those skilled in the art can, under the guidance of this application, improve and implement this solution in combination with their own capabilities. Some typical known structures or methods should not be obstacles for those skilled in the art to implement this application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the structure of the present invention. These should also be considered within the scope of protection of the present invention, and will not affect the effectiveness of the implementation of the present invention or the practicality of the patent. The scope of protection claimed in this application should be determined by the content of its claims, and the specific embodiments described in the specification can be used to interpret the content of the claims.

Claims

1. An intrusion detection method based on density divergent clustering, characterized in that, include: Obtaining a dataset for network intrusion detection Density divergent clustering is performed to obtain attack data; Density divergent clustering includes: For dataset Calculate the Euclidean distance between all feature data points pairwise, and use the preset percentile of all Euclidean distances as the cutoff distance. ; Based on Euclidean distance and cutoff distance Calculate the density of each feature data point. ,in The range of values ​​is , The total number of feature data points; According to density Density divergent clustering is performed on the feature data points to assign them to the corresponding clusters and obtain clustering results containing several clusters. Based on the clustering results, a judgment index is constructed using quartiles to identify and extract abnormal clusters and obtain attack data; The density Density divergent clustering is performed on the feature data points to obtain clustering results containing several clusters, including: S30301. Define the density gradient and feature data points. With feature data points The density gradient between them is: ； S30302, Define density-divergent neighbors: in, To preset the density gradient threshold, Indicates distance from feature data points Recent A set consisting of feature data points; S30303: Find the point with the highest density among the unassigned feature data points. Establish a new cluster ; S30304, Calculate density diverging neighbors And join New additions to recursive calculations The density of the feature data points diverges from the neighbors and all are added. ; S30305. Determine if there are still unassigned feature data points. If yes, execute S30303; otherwise, execute S30306. S30306. Output each cluster as the clustering result; The clustering results are analyzed using quartiles to construct a criterion for identifying and extracting anomalous clusters, thereby obtaining attack data, including: Calculate the array consisting of the number of all clusters interquartile interval : ； in, It is the first quartile. It is the third quartile; Determine if the number of feature data points in each cluster is less than If so, then the cluster is determined to be an anomalous cluster; where This is the adjustment coefficient; The characteristic data in the abnormal cluster is used as attack data and output.

2. The intrusion detection method based on density divergent clustering according to claim 1, characterized in that, The dataset for obtaining network intrusion detection ,include: Obtain feature data for network intrusion detection and form a dataset. ; For dataset Perform preprocessing to obtain the preprocessed network intrusion detection dataset. .

3. The intrusion detection method based on density divergent clustering according to claim 2, characterized in that, The characteristic data includes: network connection duration, protocol type, data traffic, service type, login attempts, and file access.

4. The intrusion detection method based on density divergent clustering according to claim 2, characterized in that, The preprocessing includes: standardization and dimensionality reduction; For dataset The feature data in the data are standardized. Composition of standardized feature data Data matrix ,in For the sample size, As the eigenvalues, principal component analysis is used to analyze the data matrix. Perform dimensionality reduction to obtain ; Output the dimensionality-reduced dataset As a preprocessing result.

5. The intrusion detection method based on density divergent clustering according to claim 1, characterized in that, The preset percentage is 5%.

6. The intrusion detection method based on density divergent clustering according to claim 1, characterized in that, The density The calculation process is as follows: ； in, Representing feature data points With feature data points The Euclidean distance between them This is an indicator function; it takes the value 1 if the condition is true and 0 if the condition is false.

7. The intrusion detection method based on density divergent clustering according to claim 1, characterized in that, The It is 0.

1. It is 10.

8. The intrusion detection method based on density divergent clustering according to claim 1, characterized in that, The It is 1.5.

Images