An Anomaly Intrusion Detection Algorithm Based on Minimal Diversity Semi-supervised Clustering

An anomaly intrusion detection algorithm based on minimal diversity is proposed. It can deal with mixed attributes, so overcomes the deficiencies of most unsupervised learning methods. Based on the minimal diversity measurement, we use a small amount of marked data to guide clustering. When detecting new records, we calculate its diversity from the existing clusters to determine its category. This algorithm can detect known and unknown types of attacks, and update detection model automatically. The simulative experiment indicates that the new algorithm improves the performance of detecting attacks, and it is more effective than K-means intrusion detection method.