Network abnormality detection method based on data mining

Abstract

The invention discloses a network abnormality detection method based on data mining, which adopts a system standard input and output stdio, a system standard library stdlib and a system mathematical function library math and comprises the steps of: firstly, starting up a master program file detection.cpp, reading in data to be detected and carrying out preprocessing; calling a cluster analysis and generation module clust.cpp, using an individual obtained in the previous step as an initial center point of a cluster partitioning method, and by the module, carrying out partitioning on the data and generating a cluster; calling a data readability conversion module trap.cpp to carry out marking on the generated cluster, and determining types of normal data and abnormal data; and by an alert module alert.cpp, outputting information of the normal data and the abnormal data to a control console. According to the network abnormality detection method disclosed by the invention, a data mining technology is effectively applied to intrusion detection, and an application based on intrusion detection needs to improve an original clustering analysis algorithm, so that the algorithm can be suitable for an environment and a data type of intrusion detection, an aim of intrusion detection is fulfilled, a detection rate of intrusion detection is improved and a false alarm rate is reduced.

Description

technical field [0001] The invention belongs to the field of computer application technology, and more specifically relates to a data mining-based network anomaly detection method. Background technique [0002] Data mining is the process of mining interesting knowledge from large amounts of data stored in databases, data warehouses, or other information repositories. Data mining digs out important information and extracts valuable knowledge from a large number of fuzzy and noisy original data in the database according to certain rules. Data mining technology is an interdisciplinary subject, involving many fields such as intrusion detection, intelligent database and machine learning, and data mining has become a popular research topic. The application of data mining technology in intrusion detection can improve the detection efficiency and enhance the adaptability and expansibility of the system. The intrusion detection system based on data mining can well protect the secur...

AI Technical Summary

Problems solved by technology

[0007] 1. These technologies belong to the category of static security technology, and cannot actively track intruders. At the same time, the security strategy in static defense sacrifices some rights of users, which is contrary to the openness and sharing of the network;

[0008] 2. Unable to prevent attacks from within the system, and unable to do anything about the abuse of computers and their resources by authorized users;

[0009] 3. Due to performance limitations, real-time monitoring cannot be provided