An Intrusion Detection Method Based on Clustering Multidimensional Sets

Most of clustering methods focus on single-dimensional or inter-dimensional data. The paper extends the concept of single-dimensional set to multidimensional set, which is a kind of set whose element is also a single-dimensional set. The paper first presents the definition and similarity model of multidimensional set, whose distance space is proved to be a metric space. Then a database anomaly detection algorithm MSDensity is presented, which defines distance between queries by their results and looks on their results as multidimensional sets based on duple identifiers and querying attributes. For the main intention of users is to get data in database, result sets of queries can describe the actions of users more accurately. And since a metric index tree can be used for detection algorithm, a faster speed for detecting real-time query can be acquired and the experiment results also show it