基于混沌粒子群的IDS告警聚类算法

doi:10.3969/j.issn.1000-436x.2013.03.013

通信学报 ›› 2013, Vol. 34 ›› Issue (3): 105-110.doi: 10.3969/j.issn.1000-436x.2013.03.013

基于混沌粒子群的IDS告警聚类算法

胥小波^1,²,蒋琴琴²,郑康锋²,武斌²,杨义先²

¹ 中国电子科技集团公司第三十研究所，四川成都 610041
² 北京邮电大学信息安全中心，北京 100876

出版日期:2013-03-25 发布日期:2017-07-20
基金资助:
中央高校基本科研业务费专项基金资助项目;总装基金资助项目;教育部科学技术研究重点基金资助项目

IDS alert clustering algorithm based on chaotic particle swarm optimization

Xiao-bo XU^1,²,Qin-qin JIANG²,Kang-feng ZHENG²,Bin WU²,Yi-xian YANG²

¹ The 30th Institute of China Electronics Technology Group Corporation, Chengdu 610041, China
² Information Security Center, Beijing University of Posts and Telecommunications, Beijing 100876, China

Online:2013-03-25 Published:2017-07-20
Supported by:
The Fundamental Research Funds for the Central Universities;The Research Foundation of CPLA General Equipment Department;The Key Project of Chinese Ministry of Education

摘要/Abstract

摘要：

为了提高入侵检测系统(IDS)的告警质量，减少冗余报警，提出了一种基于混沌粒子群优化的IDS告警聚类算法。算法将混沌融入到粒子运动过程中，使粒子群在混沌与稳定之间交替运动，逐步向最优点靠近。该算法能够克服粒子群算法的早熟、局部最优等缺点，指导聚类中心寻找到全局最优解。通过理论分析与实验测试，验证了该算法在入侵检测系统中，能够大量减少告警数量，提高告警质量，具有较高的检测率和较低的误报率。

关键词: 入侵检测系统, 告警聚类, 混沌, 粒子群优化

Abstract:

In order to improve the quality of alerts in intrusion detection system (IDS) and reduce the large number of redundant alarms, an IDS alerts clustering algorithm based on chaotic particle swarm optimization was proposed.It made the motion of particles with characteristics of chaos,so as to make particles move between the state of chaos and stable, and gradually close to the optimal value. The CPSO algorithm could overcome the problem of premature and local opti-mization, and take the center of cluster to find the global optimal solution. The analysis and experiment show that the al-gorithm can significantly reduce the number of alerts improve its quality, and has a high detection rate and low false detection rate.

Key words: intrusion detection system, alert clustering, chaos, particle swarm opti ization

胥小波,蒋琴琴,郑康锋,武斌,杨义先. 基于混沌粒子群的IDS告警聚类算法[J]. 通信学报, 2013, 34(3): 105-110.

Xiao-bo XU,Qin-qin JIANG,Kang-feng ZHENG,Bin WU,Yi-xian YANG. IDS alert clustering algorithm based on chaotic particle swarm optimization[J]. Journal on Communications, 2013, 34(3): 105-110.

图/表 2

参考文献 12

[1]	VAARANDIR . Real-time classification of IDS alerts with data min-ing techniques[A]. MILCOM 2009[C]. Boston, Massachusetts: IEEE Press, 2009. 1-7.
[2]	AI-MANIRYS O , ZHANGH L , ABBASA R . IDS alarms reduction using data mining[A]. WCCI 2008[C]. Hong Kong, China: IEEE Press, 2008. 3564-3570.
[3]	PIETRASZEKT . Using adaptive alert classification to reduce false positives in intrusion detection[A]. RAID 2004[C]. Sophia Antipolis, France: Springer-Verlag. 2004. 102-124.
[4]	VIINIKKAJ , DEBARH , ANSSIL , et al. Processing intrusion detec-tion alert aggregates with time series modeling[J]. Information Fusion Journal, 2009,10(4): 312-324.
[5]	VAARANDIR , PODINSK . Network IDS alert classification with frequent item-set mining and data clustering[A]. CNSM 2010[C]. Niagara Falls, Canada, IEEE Press, 2010. 451-456.
[6]	NJOGUH W , LUOJ W . Using alert cluster to reduce IDS alerts[A]. ICCSIT 2010[C]. Chengdu, China, IEEE Press, 2010. 467-471.
[7]	FEIA , DONGX L . Hierarchically clustering IDS alarms using a GA with vary-lengthed chromosomes[A]. ISIP 2010[C]. China: IEEE Press, 2010. 172-177.
[8]	LIY Z , YANGG , XUJ , et al. Anomaly detection for clustering algo-rithm based on particle swarm optimization[J]. Journal of Jiangsu University of Science and Technology(Natural Science Edition), 2009,23(1): 51-55.
[9]	WENZ W , LIR J . Fuzzy C-means clustering algorithm based on improved PSO[J]. Application Research of Computers, 2010,27(7): 2520-2522.
[10]	XUX B , ZHENGK F , LID , et al. A new chaos-particle swarm opti-mization algorithm[J]. Journal on Communications, 2012,33(1): 24-30.
[11]	LIL X , YANGY X , PENGH P , et al. An optimization method in-spired by chaotic ant behavior[J]. International Journal of Bifurcation and Chaos, 2006,16: 2351-2364.
[12]	SOLER V , MIRAMONTESO , GOODWINB C . Oscillations and chaos in ant societies[J]. Journal of Theoretical Biology, 1993,161(3): 343-357.

聚类数 K	PSO-KM聚类算法		本文CPSO-KM聚类算法
聚类数 K	检测率	误警率	检测率	误警率
20	73.7	0.91	75.4	0.82
30	86.7	1.36	90.3	1.13
40	85.3	2.47	88.9	1.87
50	76.4	2.58	81.6	1.94
60	69.8	2.12	75.3	1.53
70	69.7	1.78	7.6 5	1.08
80	69.7	1.78	74.5	1.05
平均	74.43	1.86	80.35	1.35

[1]	张海波, 兰凯, 陈舟, 王汝言, 邹灿, 王明月. 车联网中基于环的匿名高效批量认证与组密钥协商协议[J]. 通信学报, 2023, 44(6): 103-116.
[2]	赵庶旭, 韦萍, 王小龙. 多任务并发边缘计算环境中最优联盟结构生成策略[J]. 通信学报, 2023, 44(2): 172-184.
[3]	闫文浩, 姜子敬, 黄欣, 朱淑娟, 丁群. 广义二维多项式混沌映射及其在信息传输中的应用[J]. 通信学报, 2022, 43(9): 80-89.
[4]	李翠然, 王雪洁, 谢健骊, 吕安琪. 基于改进PSO的铁路监测线性无线传感器网络路由算法[J]. 通信学报, 2022, 43(5): 155-165.
[5]	黄英, 万泽含, 雷菁, 赖恪. 基于QCSK的持续噪声式隐蔽传输方案[J]. 通信学报, 2022, 43(4): 123-132.
[6]	杨华, 王宇, 徐思远, 蒋国平. 跳时短参考载波索引差分混沌移位键控通信方案[J]. 通信学报, 2022, 43(3): 113-123.
[7]	曹阳, 钟烨, 彭醇陵, 彭小峰. 基于混合供能和能量协作的异构网络能量效率优化算法[J]. 通信学报, 2022, 43(3): 135-147.
[8]	毛伊敏, 甘德瑾, 廖列法, 陈志刚. 基于Spark框架和ASPSO的并行划分聚类算法[J]. 通信学报, 2022, 43(3): 148-163.
[9]	董有恒, 赵耿, 马英杰. 基于分区初等元胞自动机的二维伪随机耦合映像格系统及其动态特性[J]. 通信学报, 2022, 43(1): 71-82.
[10]	张海波, 黄宏武, 刘开健, 贺晓帆. 车联网中可证安全的匿名可追溯快速组认证协议[J]. 通信学报, 2021, 42(6): 213-225.
[11]	苏新, 薛淏阳, 周一青, 朱金秀. 面向海洋观监测传感网的计算卸载方法研究[J]. 通信学报, 2021, 42(5): 149-163.
[12]	孙爱晶, 李世昌, 张艺才. 基于PSO优化模糊C均值的WSN分簇路由算法[J]. 通信学报, 2021, 42(3): 91-99.
[13]	田有亮,吴雨龙,李秋贤. 基于信息论的入侵检测最佳响应方案[J]. 通信学报, 2020, 41(7): 121-130.
[14]	万求真,周昭腾. 具有多参数恒Lyapunov指数谱的新型统一混沌系统[J]. 通信学报, 2020, 41(6): 202-213.
[15]	义理林,柯俊翔. 混沌保密光通信研究进展[J]. 通信学报, 2020, 41(3): 168-181.

基于混沌粒子群的IDS告警聚类算法

IDS alert clustering algorithm based on chaotic particle swarm optimization

在线阅读

PDF下载

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 2

参考文献 12

相关文章 15

Metrics

推荐阅读 0