Research on initial clustering centers of fuzzy c-means algorithm and its application to intrusion detection

The fuzzy c-means (FCM) algorithm is more suitable for intrusion detection because of its good clustering efficiency, but the performance of the FCM algorithm severely depends upon the choice of the initial cluster centers. In this paper we propose a new strategy to determine the clustering number and initial clustering centers according to the actual situation of intrusion detection data, the strategy firstly extracted the features data by training data of intrusion detection, and then put these features data as initial clustering centers into the sample set to be detected to implement clustering analysis, finally to implement dichotomy clustering for each cluster set to discover new type network attacks. Simulation experiments shows that the strategy not only has higher classification accuracy, but also effectively find new type network attacks.