Intrusion Detection Based on Adaptive Polyclonal Clustering

Adaptive polyclonal algorithm is the improved one of clonal selection algorithm, and its convergence speed is much faster. This paper intends to direct a novel clustering analysis by means of the affinity function that the adaptive polyclonal clustering strategy affects. The clustering algorithm has the advantage that it does not depend on priori knowledge and has nothing to do data distribution, effectively overcoming the disadvantage that some existing algorithms are sensitive to initialization and easy to be trapped into the local optima. This algorithm clusters large data sets with mixed numeric and categorical values effectively. The intrusion detection system based on this algorithm can deal with massive unlabeled data to distinguish between normal and anomaly and even can detect unknown attacks. The computer comparison-contrast simulations through the KDD CUP 99 datasets show that the algorithm discussed in this paper has much superior detection rate and less false positive rate when compared with AiNet algorithm, the algorithm of L. Portnoy (2000) and the algorithm of L. Jing and L. Fang (2004)