Abstract: The massive traffic of network data flow deteriorates the real-time performance for intrusion detection system, therefore compressing the train data can speed up the efficiency on unknown sample classification. As to improve the speed of data compressing and clustering on large volume of dataset, an improved adaptive affinity propagation method is proposed. The samples closer to the cluster center are directly linked to the center without clustering, which can sharply reduce the final cluster amounts as well as the full cost of clustering. Then the clustering parameters can be continuously adjusted depending on the cluster associations to refine the clustering result. Application analysis results on two datasets of intrusion detection demonstrate that the proposed method can identify the representative samples from the initial large amount of data, and speed up the efficiency of detection without reducing the model accuracy.

Key words: intrusion detection; sample; clustering; affinity propagation; adaptive