A Network Intrusion Detection Method Based on Improved K-means Algorithm

Abstract

K-means algorithm could be used in intrusion detection, and selection of initial cluster centers was one of the most important factor that influenced the clustering performance, traditional method had a certain degree of randomness in dealing with this problem, therefore, information entropy was introduced into the process of cluster centers selection, and a fusion algorithm combining with information entropy and K-means algorithm was proposed, information entropy value was used to measure the similarity degree among records, it could help to choose a least similar record to be a cluster center. Comparison results show that the detection ratio and false alarm ratio of the proposed method is better than traditional K-means algorithm.