A Time Stamped Clustering Method for Intrusion Detection

摘要

This paper proposed a new algorithm based on time stamped hierarchical clustering for intrusion detection. It incrementally clusters incoming data objects of normal behavior, and produces a precise model. Using each clusters time stamp, the algorithm can dynamically remove some expired clusters from the model, and also can produces some new cluster, that makes our clustering method more suitable for real network environment. Experiments with KDDCUP 1999 data set show our algorithm is less sensitive to noise data objects than ADWICE, and has low computer resource consumptions.