A Negotiation-based TDMA MAC Scheme for Ad Hoc Networks from ...
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
2541
Network Intrusion Detection Technology based on Improved C-means Clustering Algorithm Yanjun Wang College of Xi’an Eurasiar, Shanxi Xi’an, China Email: [email protected]
Abstract—Current intrusion detection systems have low detection rate and high false positive rate for new intrusion types. This article applied PSO in network security area, a novel intrusion detection method based on chaos Particle Swarm Optimization and Fuzzy C-Means Clustering is proposed in order to solve the problem of FCM which is much more sensitive to the initialization and easier to fall into local optimization. This method can quickly obtain global optimal clustering and can detect unknown intrusions efficiently, it does not need to classify the training data sets with artificial or other methods. The experimental results show that this method can detect unknown intrusions with lower false positive rate and higher true positive rate. Index Terms—Chaos Particle Swarm Optimization; Fuzzy C-means Clustering; Intrusion Detection; False Positive Rate
I.
INTRODUCTION
With the increasing development of computer and network technology, social information degree increases gradually, so the risk and the possibility of network intrusion is becoming bigger. Network security has become unavoidable problem to people. In order to protect core information in system and network, intrusion detection system generated, which has draw more attention in network security field [1] [2] [3]. The common problem of current intrusion detection systems is that they can detect known types of intrusion behavior effectively and can not detect new types of intrusion effectively. High rate of false positive and real time is not enough when detecting attacks. Aimed at reducing the rate of false positive and false negative, intrusion detection method improving the detection efficiency of is still the focus of intrusion detection technology. Anomaly detection model in intrusion detection system assumes that all intrusion activities are unusual. Because data instances belong to the same category in a reasonable scale condition is close to each other in the feature space and the different categories of data instances are away from each other. So clustering algorithm can be applied to the intrusion detection system. Domestic and foreign scholars have given a preliminary study on this issue. In 2001, Leonid Portnoy in Columbia University used the idea of clustering to solve the problem of knowledge acquisition in the intrusion detection system for the first time. Without any prior knowledge of network data, according to two basic assumptions of the network data, © 2013 ACADEMY PUBLISHER doi:10.4304/jnw.8.11.2541-2547
the result set of training data clustering is used to detect intrusions. Portnoy gave whole idea of solving the problem, but the detected data set contains the entire huge amount of training data, so it is difficult in the actual network environment. At the same time, the efficiency of the clustering algorithm also needs to be further improved. Considering that the core of the intrusion detection method based on clustering algorithm is efficient clustering algorithm, so it is necessary to analyze the current commonly used clustering algorithm. Selforganizing feature map (SOM) neural network is a kind of commonly used clustering method, but it has some limitations. When learning model is small, the network clustering effect depends on the order of input mode and the initial state of network connection weight vector has great influence on the performance of network convergence, which is not suitable for large-scale data. Fuzzy C-means (FCM) clustering algorithm [4] [5] [6] is a kind of widely used fuzzy clustering algorithm. Because FCM algorithm method uses gradient descent method to find the optimal solution, there exists the local optimal problem and convergence speed of the algorithm is affected by the initial value greatly, but it can handle large data sets, which is close to the actual network environment. People introduce evolutionary computation into fuzzy clustering to hope to achieve the goal of global optimization and fast convergence, which has formed the fuzzy clustering algorithm based on evolutionary computation, such as the method based on simulated annealing method, the method based on genetic algorithm and evolutionary strategy, etc [7-12]. Particle swarm optimization algorithm is a stochastic optimization technique, which is more efficient than genetic algorithm, so the fuzzy clustering based on PSO algorithm is a very meaningful study direction. At present, there has been some clustering algorithm based on PSO algorithm put forward. PSO algorithm was used in image clustering and two PSO method based on K-means was proposed also. As a swarm intelligence algorithm, particle swarm optimization (PSO) algorithm has been one of the research hotspots in the international artificial intelligence field at present [13-16]. It takes advantage of colony to find new avenue for the solution of complex problems. Therefore, to study and master the characteristics and rule of PSO is a task that is significant in both theory and application areas. In addition, in view of its wide market prospect, extending its application
2542
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
scope is also very important in practice. PSO have been applied efficiently, but as a new and developing research filed, PSO is still far from mature on systematization and standardization theory and application extending [17-20]. This article concentrates the research on the theory and application of PSO, based on the analysis of research methods and algorithm frame, several aspects of PSO such as basic principle, algorithm characters, improvement and realization are systematically discussed. Parameters and convergence greatly influence the performance and efficiency of PSO, this paper studies the convergence of PSO using the theory of difference equation, discusses the influence with the convergence of PSO by the track and the velocity of particle, and the guideline of better choosing the parameters is given. A chaos particle swarm optimization algorithm is introduced to overcome the problem of premature convergence. In the next section, we introduce fuzzy cmeans clustering. In Section 3 we introduce a new intrusion detection algorithm based on chaos particle swarm optimization and fuzzy c-means clustering. In Section 4, we do empirical research based on proposed intrusion detection method. In Section 5 we conclude the paper and give some remarks. II.
FUZZY C–MEANS ALGORITHM
The given data set is X {x1 , x2 , xn } . Fuzzy cmeans method divide n number of data sets into c number of subclass. Each subclass has a clustering center. And then according to the distance between each data object in data set and cluster center, some fuzzy subsets of the same nature are formed. Each data object and cluster center have a membership and make objective function of non-similarity index minimum. FCM uses the method of fuzzy dividing which determines the degree belonging to every subclass according to membership of [0,1] for each given data object. uij represents membership of the j-th category of the i-th sample in the data set. uij meets the following conditions. uij [0,1], i 1, 2, c
u
ij
j 1
, n; j 1, 2,
1, i, i 1, 2,
n
0 uij n, j, i 1, 2,
,c .
, n; j 1, 2,
, n; j 1, 2,
(1)
,c .
(2)
, c . (3)
i 1
Clustering center vector of the i-th class is vi . Objective function of t time is shown in (4). n
c
J (U ,V ) uijm xi v j . 2
(4)
U [uij ]nc making J (U ,V ) minimum and solve class
center v (v1 , v2 , , vc ) . When Ii { j |1 j c, dij 0} ,
do
partial
differential to U for J (U ,V ) and use Lagrange multiplier method, we obtain (5). 1 uij x v j i
1
m 1 2
1 j 1 x v j i c
1
m 1 . 2
(5)
For I i , (6) sets up and clustering center vector is shown in (7). i H i 0 . uij 1 i Ii n
n
i 1
j 1
v j uijm xi / uijm , j 1, 2,
(6)
,c .
(7)
Iteration process of FCM clustering algorithm is as follows. Step 1. Initialize V 0 and calculate U 0 . Iteration time is k 1 . Choose the number of clustering center c and fuzzy index m . Step 2. Calculate clustering center. Given U k , according to (7), calculate V k . Step 3. Calculate membership again. Given V k , according to (5) and (6), calculate U k . Step 4. If max uijk uijk 1 , iteration stops. Otherwise k k 1 and turn to step2. is a predefined small positive number. III.
A NEW INTRUSION DETECTION ALGORITHM BASED ON PROPOSED SCHEME
A. Particle Swarm Optimization The i-th particle is labeled as X i ( xi1 , xi 2 , , xiD ) . The experienced best position is labeled as Pi ( pi1 , pi 2 , , piD ) or pbest . In the swarm the best position experienced by all particles is labeled as gbest . The speed of particle i is labeled as vi (vi1 , vi 2 , , viD ) . Particle coordinate and speed adjustment equation are (8) and (9) respectively. vidk wvidk 1 c1rand1 ( pid xidk 1 ) c2 rand 2 ( pgd xidk 1 ).
xidk xidk 1 vidk 1 .
(8)
(9)
i 1 j 1
m(m 1) is fuzzy index. Actually this objective function represents weight distance square sum between all kinds of feature points and clustering center. Clustering problem is to solve membership matrix
© 2013 ACADEMY PUBLISHER
c1 and c2 are constant. w represents inertia weight, rand1 are rand 2 random numbers belonging to [0,1] . i 1, 2, , M , M represents the number of particle in the swarm. xidk the d-th dimension component of position
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
vector for particle i in the k-th iteration and vidk represents the d-th dimension component of speed vector for particle i in the k-th iteration. pid represents the d-th dimension component of individual best position pbest of particle i . pgd represents the d-th dimension component of individual best position gbest of particle i . B. An Improved Particle Swarm Optimization based on Chaos Using chaotic series initialize particle's position and speed, which does not change the randomness nature of initialization of particle swarm optimization algorithm and uses chaos to improve the population diversity and particle searching ergodicity. The optimal initialization population is chosen on the basis of generating a large number of initial population. Chaotic sequence is generated on the basis of optimal position searched by the entire particle swarm. Particle with optimal position in the generated chaotic sequence substitutes a particle's position in the current particle swarm. Search algorithm using chaotic sequence can produce many neighborhood points of optimal solution to help inert particles escape from local minimum points and quickly search the optimal solution. The following Logistic equation is a typical chaos system.
zn 1 uzn (1 zn )
n 0,1, 2,
.
(10)
u is control parameter and u 4 , 0 z0 1 . Given random initial value z0 [0,1] , a certain time sequence can generate by means of iteration. The z1 , z2 , z3 , objective function is shown in (11).
min f ( x1 , x2 ,
, xn ) s.t.ai xi bi .
(11)
In the algorithm, global optimal value is always better than current fitness value of all individuals. Scale of particle swarm is N . If f avg is average value of current fitness of all particles, (12) sets up. f avg
1 N fi N i 1
(12)
f i is particle fitness value of current iteration time. f g is fitness value of the optimal particle. Fitness value ' better than f avg is averaged to get f avg and ' f g f avg , which is used for evaluation of degree of
premature convergence of particle swarm. The smaller means that the particle swarm is more tend to be premature convergence. In the proposed algorithm, Groups can be divided into three subgroups depending on the individual fitness. Using different adaptive operation makes groups always keep the diversity of inertia weight. Particles with smaller inertia weight are used for local optimization to accelerate convergence of algorithm. Particles with larger inertia weight are used for global optimization at the early stage, and later used to jump out of local optimum to avoid premature convergence. © 2013 ACADEMY PUBLISHER
2543
Particles with different inertia weight take responsibility, global optimization and local optimization are doing at the same time, which make a balance between global convergence and convergence speed. The adjustment of inertia weight w is as follows for particle with fitness value f i . Particles meeting the condition of f i better than ' are better particles in the swarm and are close to f avg global optimum, so these particles should be endowed with smaller inertia weight to speed up to the global optimal convergence. Inertia weight is adjusted according to (13).
w w ( w wmin )
' fi f avg ' f g f avg
.
(13)
wmin 0.5 is the smallest value of w . Particles meeting the condition of f i better than f avg ' but worse than f avg have good ability of global optimization and local optimization ability. If inertia weight decreased according to the law of cosines as the search progresses. At the beginning w can keep bigger value to improve search efficiency for a long time and lately it can keep smaller value to improve search precision for a long time. w is adjusted according to (14).
w wmin (wmax wmin )
1 cos((iter 1) / ( Mstep 1)) (14) 2
wmax is the biggest w when searching starts and wmin is the smallest w when searching stops. iter is iteration steps and Mstep is the maximum iteration steps. Particles meeting the condition of f i worse than f avg are the worst particles in the swarm and its inertia weight is adjusted according to (15). w 1.5
1 . 1 k1 exp(k2 )
(15)
When algorithm stops, if particle distribution is relatively dispersed, is bigger and according to (15) w is reduced to strengthen local optimization, which makes the group tend to convergence. If particle distributes intensively, is smaller and (15) increases w of particle, which makes particle has strong detection capability to effectively jump out of local optimum. The improved algorithm based on PSO and chaos is as follows. Step 1. Initialize the maximum number of iteration or fitness error limit and related parameters. Step 2. Initialize particle position and velocity in chaos. 1) Produce a n-dimension vector and each component value is between 0 and 1. z1 ( z11 , z12 , , z1 n ) , n is the number of variable of objective function. According to (10), we obtain N number of vector z1 , z2 , , zN . 2) Calculate value interval corresponding to each component of zi .
2544
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
3) Calculate fitness value of particle swarm and choose M number of solution from N number of initial population as initial solution. Produce M number of initial velocity. Step 3. If fitness value of particle is better than individual extreme pbest , pbest is set as new position. Step 4. If fitness value of particle is better than global extreme gbest , gbest is set as new position. Step 5. Update the velocity and position according to (8) and (9). Step 6. Do chaos optimization for optimal position Pg ( pg1 , pg 2 , , pgD ) , which is mapped to definition domain of Logistic equation. zi ( pgi ai ) / (bi ai ) , i 1, 2, , D . Then chaos variable sequence zim (m 1, 2, ) is produced using Logistic equation. According to (16) chaos variable sequence is mapped to original solution space inversely. pgim ai (bi ai ) zim .
(16)
m So we obtain pgm ( pgm1 , pgm2 , , pgD ) , m 1, 2, . In original solution space, calculate fitness value for each solution pgm that chaos variable experienced and produce
solution with the best performance p . Step 7. Use p to substitute position of a random particle. Step 8. Judge whether algorithm meets stopping condition. If it meets the condition, turn to step 10. Otherwise turn to step 9. Step 9. According to fitness value, use corresponding inertia weight adjustment method and turn to step 3. Step 10. If it meets stopping condition, stop searching process and output global optimal position. C. Intrusion Detection based on Chaos Particle Swarm Optimization and Fuzzy C-Means Clustering Particle swarm algorithm used real number code and a code corresponds to a feasible solution, which is helpful to improve computational complexity of the particle swarm algorithm and improve operation efficiency. Solution of optimized problem is to find optimal clustering center, so coding method based on clustering center is adopted meaning that position of each particle is composed of c number of clustering center. The length of particle is D c s and s is dimension of clustering center. c number of clustering center constitutes a particle in order and the component of particle represents its position in the space. In order to find out global extreme and individual extreme, we must evaluate fitness value for each particle. Fitness value is calculated by (17). f ( xi )
1 . J (U ,V ) 1
(17)
If clustering performance is good, J (U , V ) is small and f ( xi ) is big. Track particle fitness in each iteration © 2013 ACADEMY PUBLISHER
to find optimal solution that this particle can find currently and can find the optimal solution of the particle. In the process of intrusion detection clustering, algorithm steps to initialize clustering are as follows. Step 1. Initialize blank clustering set. Step 2. Take the first data of standardized data set to set up the first clustering and save it to class set. Step 3. For each new data sample instance xi , calculate the distance between the data sample instance and clustering center of established clustering sets. The minimal distance is labeled as d min . Step 4. d 0 is predefined clustering radius. If dmin d0 , it is put into existing cluster and then go on dealing with next instance data. If distance between current instance and all clustering instances of clustering cluster is more than d 0 , define a new cluster taking this instance as center and plus it to clustering sets. Step 5. When all data in the training sample set are processed completely, it stops. Otherwise turn to step3. After the above clustering algorithm, we will get a clustering cluster after preliminary clustering, which includes N categories. The next process is to carry out clustering algorithm based on chaos particle swarm and fuzzy c-means clustering, which is as follows. Step 1. Initialize particle swarm and parameter. Given fuzzy index m , particle swarm scale n and N is the number of clustering. Calculate membership matrix according to (5) and (6). Clustering center constitutes a particle and initialize the speed of the particle. After n times, n number of individuals including n N samples are constituted. TABLE I.
TYPES AND NUMBER OF ATTACKS IN TRAINING DATA SET
BigClassName DoS(295) U2R(118) R2L(210) Probing(157)
Small class name and number neptune(141), smurf(154) buffer_overflow(30), perl(6), rootkit(20), xterm(35), ps(27) xsnoop(12), sendmail(19), xlock(15), named(17), write(12), guess_passwd(45) ipsweep(50), nmap(38), satan(69)
Step 2. According to (7) calculate new clustering center and according to (5) and (6) calculate corresponding membership matrix. At the same time, corresponding particles are constituted. Step 3. For all particles in the swarm, do the following operations. 1) Update the velocity and position according to (8) and (9). 2) If fitness value of particle is better than individual extreme pbest , pbest is set as new position. If fitness value of particle is better than global extreme gbest , gbest is set as new position. Step 4. Do chaos optimization for optimal position Pg ( pg1 , pg 2 , , pgD ) , which is mapped to definition domain of Logistic equation. zi ( pgi ai ) / (bi ai ) , i 1, 2, , D . Then chaos variable sequence
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
zim (m 1, 2, ) is produced using Logistic equation. According to (16) chaos variable sequence is mapped to original solution space inversely. So we obtain m pgm ( pgm1 , pgm2 , , pgD ) , m 1, 2, . In original solution
space, calculate fitness value for each solution pgm that chaos variable experienced and produce solution with the best performance p . Step 5. Choose a particle from current population and substitute it with p Step 6. Judge whether algorithm meets stopping condition. If it meets the condition, algorithm stops. Otherwise turn to step 2. TABLE II. type
DETECTION RATE TO KNOWN AND UNKNOWN ATTACK WHEN T =20% The third group of data Known Unknown intrusion intrusion 62. 7% 47. 3% 75. 6% 73. 5% 50. 3% 25. 4% 81. 4% 75. 6% 67. 5% 55. 5%
DoS U2R R2L Probing Total
The fourth group of data Known Unknown intrusion intrusion 60. 3% 44. 8% 83. 2% 61. 3% 63. 5% 18. 8% 84. 1% 78. 9% 72. 8% 51. 0%
In the generated clustering, if some clustering is aggregated by normal data, the number of data it includes is much more than the number of data included by intrusion data cluster. So all the clusters can be ordered according to the amount of data and set a proportional number T as detection threshold. The clusters over T including the most amount of data is taken as normal clusters and the rest clusters is taken as abnormal. Ci , i 1, 2, , N is original cluster and T (0,1) . IV.
2545
aggregate behind. Smaller T means that there are a lot of abnormal data and the detection rate will increase. But in actual situation, because each class may include the distributed error data, that is to say, the normal class must also contain abnormal data, in the same way the abnormal class also contains the normal data. So when the detection threshold is larger, the rate will be reduced and the rate of false positive decreases. When T 20% , the performance of algorithm is the best, therefore the threshold is fixed to test performance of detection of the unknown attack of proposed algorithm in this paper. Detection rate to known and unknown attack when T =20% is shown in table II. We can see that detection performance of U2R and Probing intrusion attack are better than detection performance of DoS and R2L intrusion attack. This is because there are a lot of R2L invasion disguising as legitimate user identity to attack, which makes its characteristics similar to normal packet and produces low detection rate of the algorithm. Training set contains many DoS intrusion, so intrusion data can be labeled as normal data to produce low detection rate. But overall, detection rate of unknown intrusion of the algorithm is over 50%, meaning that our proposed algorithm based on improved particle swarm and fuzzy c-means clustering can be more effective to detect the unknown intrusion behavior.
EXPERIMENT AND RESULT ANALYSIS
To evaluate the performance of the intrusion detection method based on chaos particle swarm optimization and fuzzy c-means clustering, this paper does experiment based on the KDD CUP99 dataset. The data set includes 22 kinds of attacks and 1 kind of normal type. We take 75258 records from the test set as training sample set, which contains 780 number of intrusion data. Types and number of attacks in training data set is shown in table I. In the test of sample set selection, a total of four sets of data are selected. The first set and second set of test set are from the training set and each set contains 37000 records. The third and fourth groups were selected from KDD CUP99 data set apart from the training set of data and contains 37000 records in each group. We deliberately choose intrusion data not included in training set. The third and fourth group data set contains unknown intrusion. The detection results with different threshold T is shown in Fig. 1. From experiment result, detection rate and the rate of false positive decreases with the increase of T. From experiment result, detection rate and the rate of false positive decreases with the increase of T. This is because in the detection algorithm generated clusters are ordered according to the size of data contained by clusters. So the normal data is in front and the anomaly data © 2013 ACADEMY PUBLISHER
Figure 1. The detection results with different threshold T.
Figure 2. Roc curve of dataset 1.
2546
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
alarm rate in the different conditions. So that ROC curve can exactly depict relationship between detection rate and false alarm rate of intrusion detection system. Fig. 2 is Roc curve of dataset 1, Fig. 3 is Roc curve of dataset 2, Fig. 4 is Roc curve of dataset 3, Fig. 5 is Roc curve of dataset 4. We can see that Detection rate and false alarm rate always synchronously increases or decreases. Increasing of detection rate will naturally accompanied by the rise of the rate of false positives, on the other hand, the low detection rate will surely lead to decline in the rate of false positives. So in the choice of detection rate and false alarm rate, we can take a compromise choice. V. Figure 3. Roc curve of dataset 2.
CONCLUSIONS
In this chapter clustering algorithm based on particle swarm optimization and fuzzy c-means clustering algorithm (PSO - FCM) is applied to intrusion detection. The proposed detection algorithm is simple and efficient and has fast detection speed. It is easy to realize global optimization and has good ability to detect unknown attack. Finally the KDD CUP99 dataset is used for the experiment. The results show that the algorithm improves the detection efficiency and algorithm is feasible and effective. So the algorithm should have broad application prospects in the field of intrusion detection. REFERENCES
Figure 4. Roc curve of dataset 3
Figure 5. Roc curve of dataset 4.
Now the evaluation of overall performance of intrusion detection system does not have a mature, systematic and normative evaluation model. Lincoln laboratory in the United States used ROC curve to reflect the relationship between detection rate and false positives. ROC test is widely used in evaluation of input uncertainty system and it takes false alarm rate and detection rate as abscissa and ordinate respectively according to detection rate and false
© 2013 ACADEMY PUBLISHER
[1] Xin Li, Lihong Jia, Shaojie Wang, Yuancheng Li, "A Rapid Hybrid Distributed Intrusion Detection Scheme for Large Scale Data Set", International Journal of Digital Content Technology and its Applications, 2013, Vol. 7, No. 5, pp. 287-295. [2] Liang Hu, Wenbo Wang, Kuo Zhao, "The Design and Implementation of Trusted Communication Protocol for Intrustion Prevention System", Journal of Convergence Information Technology, 2011, Vol. 6, No. 3, pp. 55-62. [3] Marjan Bahrololum, Elham Salahi, Mahmoud Khaleghi, "An Improved Intrusion Detection Technique based on two Strategies Using Decision Tree and Neural Network", Journal of Convergence Information Technology, 2009, Vol. 4, No. 4, pp. 96 -101. [4] Chang Yan, Chen Ai-dong, "A FCM Algorithm Based on Weighted Intuitionistic Fuzzy Set", International Journal of Digital Content Technology and its Applications, 2012, Vol. 6, No. 11, pp. 95-101. [5] Sheng Bin, Gengxin Sun, "An Algorithm for Detecting Community Structure of Complex Networks based on Clustering", International Journal of Digital Content Technology and its Applications, 2011, Vol. 5, No. 7, pp. 326-334. [6] Luo Shihua, Jia Li, "Silicon Content Prediction Using the Hybrid Model by Fuzzy C-means Clustering and Artificial Neural Networks", Advances in Information Sciences and Service Sciences, 2011, Vol. 3, No. 8, pp. 78-84. [7] Yunfei Ma, , Peifeng Niu, , Yantao Zhao, Xiaofei Ma, , "Adaptive Particle Swarm-Based Fuzzy Clustering Algorithm in the Application of Steam Drum Pulverized Coal Fired Boiler", International Journal of Advancements in Computing Technology, 2011, Vol. 3, No. 11, pp. 444452. [8] Chen xiao-ming, "Research on the Network Intrusion Detection Model with neural network parameters optimized by ant-colony algorithm", Journal of
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
[9]
[10]
[11]
[12]
[13]
[14]
Convergence Information Technology, 2013, Vol. 8, No. 5, pp. 619- 627. Zhou Lu-ping, Li Bing-rong, "The study on the Intrusion Detection Algorithm Analysis using the Improved Genetic Optimized Neural Network", Journal of Convergence Information Technology, 2013, Vol. 8, No. 5, pp. 571 -577. Xiaomei YI, Peng WU, Dan DAI, Lijuan LIU, Xiong HE, "Intrusion Detection Using BP Optimized by PSO", International Journal of Advancements in Computing Technology, 2012, Vol. 4, No. 2, pp. 268-274. Xiaoqiang WANG, "Study on Genetic Algorithm Optimization for Support Vector Machine in Network Intrusion Detection", Advances in Information Sciences and Service Sciences, 2012, Vol. 4, No. 2, pp. 282-288. CHEN Zhi-xian, WANG Ru-chuan, WANG Shao-di, et al. An intrusion detection system model based on immune principle and performance analysis. The Journal of China Universities of Posts and Telecommunications, 2005, 12(1):31-35. Meijuan Gao, Jingwen Tian, Zhenbin Zhang, "A Sludge Compost Quality Evaluation Method Based on Chaos Genetic Support Vector Machine", International Journal of Digital Content Technology and its Applications, 2012, Vol. 6, No. 23, pp. 483-491. Aijun Liu, Yu Yang, Xuedong Liang, Hao Yao, "Improved Immune Genetic Algorithm Based on Hybrid Chaotic
© 2013 ACADEMY PUBLISHER
2547
[15]
[16]
[17]
[18]
[19] [20]
Maps and Its Application", Journal of Convergence Information Technology, 2012, Vol. 7, No. 1, pp. 422-432. Kuang Ling, Yiming Tan, "Application research of the plant species monitoring Internet of Things technology based on Particle Swarm with Chaotic Mutation ", Journal of Convergence Information Technology, 2012, Vol. 7, No. 11, pp. 232-238. Han Han, Houjun Wang, , "A New Method for Analog Circuit Fault Diagnosis Based on Testability and Chaos Particle Swarm Optimization", Journal of Convergence Information Technology, 2012, Vol. 7, No. 14, pp. 444-453. Shu Fan, Fengchun Tian, Qinghua He, Pengfei Jia, Jingwei Feng, Yue Shen, “Wound Infection Recognition Based on Quantum-Behaved Particle Swarm Optimization,” Journal of Convergence Information Technology, 2012, Vol. 8, No. 5, pp. 1209-1219. Youxin LUO, Xiaoyi CHE, Lingfang LI, “Chaotic Artificial Bee Colony Hybrid Discrete Constrained Optimization Algorithm,” Journal of Convergence Information Technology, 2012, Vol. 7, No. 22, pp. 484-491. J. Sun, B. Feng, W. B Xu, “Particle Swarm Optimization with Particles Having Quantum Behavior,” Proc. 2004 Congress on Evolutionary Computation, pp. 325-331. Jun Sun, Wenbo Xu, Bin Feng, “Adaptive Parameter Control for Quantum-behaved ParticleSwarm Optimization on Individual Level,” Systems, Man and Cybernetics, IEEE International Conference, 2005, 4(10-12) pp. 3049-3054.
2541
Network Intrusion Detection Technology based on Improved C-means Clustering Algorithm Yanjun Wang College of Xi’an Eurasiar, Shanxi Xi’an, China Email: [email protected]
Abstract—Current intrusion detection systems have low detection rate and high false positive rate for new intrusion types. This article applied PSO in network security area, a novel intrusion detection method based on chaos Particle Swarm Optimization and Fuzzy C-Means Clustering is proposed in order to solve the problem of FCM which is much more sensitive to the initialization and easier to fall into local optimization. This method can quickly obtain global optimal clustering and can detect unknown intrusions efficiently, it does not need to classify the training data sets with artificial or other methods. The experimental results show that this method can detect unknown intrusions with lower false positive rate and higher true positive rate. Index Terms—Chaos Particle Swarm Optimization; Fuzzy C-means Clustering; Intrusion Detection; False Positive Rate
I.
INTRODUCTION
With the increasing development of computer and network technology, social information degree increases gradually, so the risk and the possibility of network intrusion is becoming bigger. Network security has become unavoidable problem to people. In order to protect core information in system and network, intrusion detection system generated, which has draw more attention in network security field [1] [2] [3]. The common problem of current intrusion detection systems is that they can detect known types of intrusion behavior effectively and can not detect new types of intrusion effectively. High rate of false positive and real time is not enough when detecting attacks. Aimed at reducing the rate of false positive and false negative, intrusion detection method improving the detection efficiency of is still the focus of intrusion detection technology. Anomaly detection model in intrusion detection system assumes that all intrusion activities are unusual. Because data instances belong to the same category in a reasonable scale condition is close to each other in the feature space and the different categories of data instances are away from each other. So clustering algorithm can be applied to the intrusion detection system. Domestic and foreign scholars have given a preliminary study on this issue. In 2001, Leonid Portnoy in Columbia University used the idea of clustering to solve the problem of knowledge acquisition in the intrusion detection system for the first time. Without any prior knowledge of network data, according to two basic assumptions of the network data, © 2013 ACADEMY PUBLISHER doi:10.4304/jnw.8.11.2541-2547
the result set of training data clustering is used to detect intrusions. Portnoy gave whole idea of solving the problem, but the detected data set contains the entire huge amount of training data, so it is difficult in the actual network environment. At the same time, the efficiency of the clustering algorithm also needs to be further improved. Considering that the core of the intrusion detection method based on clustering algorithm is efficient clustering algorithm, so it is necessary to analyze the current commonly used clustering algorithm. Selforganizing feature map (SOM) neural network is a kind of commonly used clustering method, but it has some limitations. When learning model is small, the network clustering effect depends on the order of input mode and the initial state of network connection weight vector has great influence on the performance of network convergence, which is not suitable for large-scale data. Fuzzy C-means (FCM) clustering algorithm [4] [5] [6] is a kind of widely used fuzzy clustering algorithm. Because FCM algorithm method uses gradient descent method to find the optimal solution, there exists the local optimal problem and convergence speed of the algorithm is affected by the initial value greatly, but it can handle large data sets, which is close to the actual network environment. People introduce evolutionary computation into fuzzy clustering to hope to achieve the goal of global optimization and fast convergence, which has formed the fuzzy clustering algorithm based on evolutionary computation, such as the method based on simulated annealing method, the method based on genetic algorithm and evolutionary strategy, etc [7-12]. Particle swarm optimization algorithm is a stochastic optimization technique, which is more efficient than genetic algorithm, so the fuzzy clustering based on PSO algorithm is a very meaningful study direction. At present, there has been some clustering algorithm based on PSO algorithm put forward. PSO algorithm was used in image clustering and two PSO method based on K-means was proposed also. As a swarm intelligence algorithm, particle swarm optimization (PSO) algorithm has been one of the research hotspots in the international artificial intelligence field at present [13-16]. It takes advantage of colony to find new avenue for the solution of complex problems. Therefore, to study and master the characteristics and rule of PSO is a task that is significant in both theory and application areas. In addition, in view of its wide market prospect, extending its application
2542
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
scope is also very important in practice. PSO have been applied efficiently, but as a new and developing research filed, PSO is still far from mature on systematization and standardization theory and application extending [17-20]. This article concentrates the research on the theory and application of PSO, based on the analysis of research methods and algorithm frame, several aspects of PSO such as basic principle, algorithm characters, improvement and realization are systematically discussed. Parameters and convergence greatly influence the performance and efficiency of PSO, this paper studies the convergence of PSO using the theory of difference equation, discusses the influence with the convergence of PSO by the track and the velocity of particle, and the guideline of better choosing the parameters is given. A chaos particle swarm optimization algorithm is introduced to overcome the problem of premature convergence. In the next section, we introduce fuzzy cmeans clustering. In Section 3 we introduce a new intrusion detection algorithm based on chaos particle swarm optimization and fuzzy c-means clustering. In Section 4, we do empirical research based on proposed intrusion detection method. In Section 5 we conclude the paper and give some remarks. II.
FUZZY C–MEANS ALGORITHM
The given data set is X {x1 , x2 , xn } . Fuzzy cmeans method divide n number of data sets into c number of subclass. Each subclass has a clustering center. And then according to the distance between each data object in data set and cluster center, some fuzzy subsets of the same nature are formed. Each data object and cluster center have a membership and make objective function of non-similarity index minimum. FCM uses the method of fuzzy dividing which determines the degree belonging to every subclass according to membership of [0,1] for each given data object. uij represents membership of the j-th category of the i-th sample in the data set. uij meets the following conditions. uij [0,1], i 1, 2, c
u
ij
j 1
, n; j 1, 2,
1, i, i 1, 2,
n
0 uij n, j, i 1, 2,
,c .
, n; j 1, 2,
, n; j 1, 2,
(1)
,c .
(2)
, c . (3)
i 1
Clustering center vector of the i-th class is vi . Objective function of t time is shown in (4). n
c
J (U ,V ) uijm xi v j . 2
(4)
U [uij ]nc making J (U ,V ) minimum and solve class
center v (v1 , v2 , , vc ) . When Ii { j |1 j c, dij 0} ,
do
partial
differential to U for J (U ,V ) and use Lagrange multiplier method, we obtain (5). 1 uij x v j i
1
m 1 2
1 j 1 x v j i c
1
m 1 . 2
(5)
For I i , (6) sets up and clustering center vector is shown in (7). i H i 0 . uij 1 i Ii n
n
i 1
j 1
v j uijm xi / uijm , j 1, 2,
(6)
,c .
(7)
Iteration process of FCM clustering algorithm is as follows. Step 1. Initialize V 0 and calculate U 0 . Iteration time is k 1 . Choose the number of clustering center c and fuzzy index m . Step 2. Calculate clustering center. Given U k , according to (7), calculate V k . Step 3. Calculate membership again. Given V k , according to (5) and (6), calculate U k . Step 4. If max uijk uijk 1 , iteration stops. Otherwise k k 1 and turn to step2. is a predefined small positive number. III.
A NEW INTRUSION DETECTION ALGORITHM BASED ON PROPOSED SCHEME
A. Particle Swarm Optimization The i-th particle is labeled as X i ( xi1 , xi 2 , , xiD ) . The experienced best position is labeled as Pi ( pi1 , pi 2 , , piD ) or pbest . In the swarm the best position experienced by all particles is labeled as gbest . The speed of particle i is labeled as vi (vi1 , vi 2 , , viD ) . Particle coordinate and speed adjustment equation are (8) and (9) respectively. vidk wvidk 1 c1rand1 ( pid xidk 1 ) c2 rand 2 ( pgd xidk 1 ).
xidk xidk 1 vidk 1 .
(8)
(9)
i 1 j 1
m(m 1) is fuzzy index. Actually this objective function represents weight distance square sum between all kinds of feature points and clustering center. Clustering problem is to solve membership matrix
© 2013 ACADEMY PUBLISHER
c1 and c2 are constant. w represents inertia weight, rand1 are rand 2 random numbers belonging to [0,1] . i 1, 2, , M , M represents the number of particle in the swarm. xidk the d-th dimension component of position
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
vector for particle i in the k-th iteration and vidk represents the d-th dimension component of speed vector for particle i in the k-th iteration. pid represents the d-th dimension component of individual best position pbest of particle i . pgd represents the d-th dimension component of individual best position gbest of particle i . B. An Improved Particle Swarm Optimization based on Chaos Using chaotic series initialize particle's position and speed, which does not change the randomness nature of initialization of particle swarm optimization algorithm and uses chaos to improve the population diversity and particle searching ergodicity. The optimal initialization population is chosen on the basis of generating a large number of initial population. Chaotic sequence is generated on the basis of optimal position searched by the entire particle swarm. Particle with optimal position in the generated chaotic sequence substitutes a particle's position in the current particle swarm. Search algorithm using chaotic sequence can produce many neighborhood points of optimal solution to help inert particles escape from local minimum points and quickly search the optimal solution. The following Logistic equation is a typical chaos system.
zn 1 uzn (1 zn )
n 0,1, 2,
.
(10)
u is control parameter and u 4 , 0 z0 1 . Given random initial value z0 [0,1] , a certain time sequence can generate by means of iteration. The z1 , z2 , z3 , objective function is shown in (11).
min f ( x1 , x2 ,
, xn ) s.t.ai xi bi .
(11)
In the algorithm, global optimal value is always better than current fitness value of all individuals. Scale of particle swarm is N . If f avg is average value of current fitness of all particles, (12) sets up. f avg
1 N fi N i 1
(12)
f i is particle fitness value of current iteration time. f g is fitness value of the optimal particle. Fitness value ' better than f avg is averaged to get f avg and ' f g f avg , which is used for evaluation of degree of
premature convergence of particle swarm. The smaller means that the particle swarm is more tend to be premature convergence. In the proposed algorithm, Groups can be divided into three subgroups depending on the individual fitness. Using different adaptive operation makes groups always keep the diversity of inertia weight. Particles with smaller inertia weight are used for local optimization to accelerate convergence of algorithm. Particles with larger inertia weight are used for global optimization at the early stage, and later used to jump out of local optimum to avoid premature convergence. © 2013 ACADEMY PUBLISHER
2543
Particles with different inertia weight take responsibility, global optimization and local optimization are doing at the same time, which make a balance between global convergence and convergence speed. The adjustment of inertia weight w is as follows for particle with fitness value f i . Particles meeting the condition of f i better than ' are better particles in the swarm and are close to f avg global optimum, so these particles should be endowed with smaller inertia weight to speed up to the global optimal convergence. Inertia weight is adjusted according to (13).
w w ( w wmin )
' fi f avg ' f g f avg
.
(13)
wmin 0.5 is the smallest value of w . Particles meeting the condition of f i better than f avg ' but worse than f avg have good ability of global optimization and local optimization ability. If inertia weight decreased according to the law of cosines as the search progresses. At the beginning w can keep bigger value to improve search efficiency for a long time and lately it can keep smaller value to improve search precision for a long time. w is adjusted according to (14).
w wmin (wmax wmin )
1 cos((iter 1) / ( Mstep 1)) (14) 2
wmax is the biggest w when searching starts and wmin is the smallest w when searching stops. iter is iteration steps and Mstep is the maximum iteration steps. Particles meeting the condition of f i worse than f avg are the worst particles in the swarm and its inertia weight is adjusted according to (15). w 1.5
1 . 1 k1 exp(k2 )
(15)
When algorithm stops, if particle distribution is relatively dispersed, is bigger and according to (15) w is reduced to strengthen local optimization, which makes the group tend to convergence. If particle distributes intensively, is smaller and (15) increases w of particle, which makes particle has strong detection capability to effectively jump out of local optimum. The improved algorithm based on PSO and chaos is as follows. Step 1. Initialize the maximum number of iteration or fitness error limit and related parameters. Step 2. Initialize particle position and velocity in chaos. 1) Produce a n-dimension vector and each component value is between 0 and 1. z1 ( z11 , z12 , , z1 n ) , n is the number of variable of objective function. According to (10), we obtain N number of vector z1 , z2 , , zN . 2) Calculate value interval corresponding to each component of zi .
2544
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
3) Calculate fitness value of particle swarm and choose M number of solution from N number of initial population as initial solution. Produce M number of initial velocity. Step 3. If fitness value of particle is better than individual extreme pbest , pbest is set as new position. Step 4. If fitness value of particle is better than global extreme gbest , gbest is set as new position. Step 5. Update the velocity and position according to (8) and (9). Step 6. Do chaos optimization for optimal position Pg ( pg1 , pg 2 , , pgD ) , which is mapped to definition domain of Logistic equation. zi ( pgi ai ) / (bi ai ) , i 1, 2, , D . Then chaos variable sequence zim (m 1, 2, ) is produced using Logistic equation. According to (16) chaos variable sequence is mapped to original solution space inversely. pgim ai (bi ai ) zim .
(16)
m So we obtain pgm ( pgm1 , pgm2 , , pgD ) , m 1, 2, . In original solution space, calculate fitness value for each solution pgm that chaos variable experienced and produce
solution with the best performance p . Step 7. Use p to substitute position of a random particle. Step 8. Judge whether algorithm meets stopping condition. If it meets the condition, turn to step 10. Otherwise turn to step 9. Step 9. According to fitness value, use corresponding inertia weight adjustment method and turn to step 3. Step 10. If it meets stopping condition, stop searching process and output global optimal position. C. Intrusion Detection based on Chaos Particle Swarm Optimization and Fuzzy C-Means Clustering Particle swarm algorithm used real number code and a code corresponds to a feasible solution, which is helpful to improve computational complexity of the particle swarm algorithm and improve operation efficiency. Solution of optimized problem is to find optimal clustering center, so coding method based on clustering center is adopted meaning that position of each particle is composed of c number of clustering center. The length of particle is D c s and s is dimension of clustering center. c number of clustering center constitutes a particle in order and the component of particle represents its position in the space. In order to find out global extreme and individual extreme, we must evaluate fitness value for each particle. Fitness value is calculated by (17). f ( xi )
1 . J (U ,V ) 1
(17)
If clustering performance is good, J (U , V ) is small and f ( xi ) is big. Track particle fitness in each iteration © 2013 ACADEMY PUBLISHER
to find optimal solution that this particle can find currently and can find the optimal solution of the particle. In the process of intrusion detection clustering, algorithm steps to initialize clustering are as follows. Step 1. Initialize blank clustering set. Step 2. Take the first data of standardized data set to set up the first clustering and save it to class set. Step 3. For each new data sample instance xi , calculate the distance between the data sample instance and clustering center of established clustering sets. The minimal distance is labeled as d min . Step 4. d 0 is predefined clustering radius. If dmin d0 , it is put into existing cluster and then go on dealing with next instance data. If distance between current instance and all clustering instances of clustering cluster is more than d 0 , define a new cluster taking this instance as center and plus it to clustering sets. Step 5. When all data in the training sample set are processed completely, it stops. Otherwise turn to step3. After the above clustering algorithm, we will get a clustering cluster after preliminary clustering, which includes N categories. The next process is to carry out clustering algorithm based on chaos particle swarm and fuzzy c-means clustering, which is as follows. Step 1. Initialize particle swarm and parameter. Given fuzzy index m , particle swarm scale n and N is the number of clustering. Calculate membership matrix according to (5) and (6). Clustering center constitutes a particle and initialize the speed of the particle. After n times, n number of individuals including n N samples are constituted. TABLE I.
TYPES AND NUMBER OF ATTACKS IN TRAINING DATA SET
BigClassName DoS(295) U2R(118) R2L(210) Probing(157)
Small class name and number neptune(141), smurf(154) buffer_overflow(30), perl(6), rootkit(20), xterm(35), ps(27) xsnoop(12), sendmail(19), xlock(15), named(17), write(12), guess_passwd(45) ipsweep(50), nmap(38), satan(69)
Step 2. According to (7) calculate new clustering center and according to (5) and (6) calculate corresponding membership matrix. At the same time, corresponding particles are constituted. Step 3. For all particles in the swarm, do the following operations. 1) Update the velocity and position according to (8) and (9). 2) If fitness value of particle is better than individual extreme pbest , pbest is set as new position. If fitness value of particle is better than global extreme gbest , gbest is set as new position. Step 4. Do chaos optimization for optimal position Pg ( pg1 , pg 2 , , pgD ) , which is mapped to definition domain of Logistic equation. zi ( pgi ai ) / (bi ai ) , i 1, 2, , D . Then chaos variable sequence
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
zim (m 1, 2, ) is produced using Logistic equation. According to (16) chaos variable sequence is mapped to original solution space inversely. So we obtain m pgm ( pgm1 , pgm2 , , pgD ) , m 1, 2, . In original solution
space, calculate fitness value for each solution pgm that chaos variable experienced and produce solution with the best performance p . Step 5. Choose a particle from current population and substitute it with p Step 6. Judge whether algorithm meets stopping condition. If it meets the condition, algorithm stops. Otherwise turn to step 2. TABLE II. type
DETECTION RATE TO KNOWN AND UNKNOWN ATTACK WHEN T =20% The third group of data Known Unknown intrusion intrusion 62. 7% 47. 3% 75. 6% 73. 5% 50. 3% 25. 4% 81. 4% 75. 6% 67. 5% 55. 5%
DoS U2R R2L Probing Total
The fourth group of data Known Unknown intrusion intrusion 60. 3% 44. 8% 83. 2% 61. 3% 63. 5% 18. 8% 84. 1% 78. 9% 72. 8% 51. 0%
In the generated clustering, if some clustering is aggregated by normal data, the number of data it includes is much more than the number of data included by intrusion data cluster. So all the clusters can be ordered according to the amount of data and set a proportional number T as detection threshold. The clusters over T including the most amount of data is taken as normal clusters and the rest clusters is taken as abnormal. Ci , i 1, 2, , N is original cluster and T (0,1) . IV.
2545
aggregate behind. Smaller T means that there are a lot of abnormal data and the detection rate will increase. But in actual situation, because each class may include the distributed error data, that is to say, the normal class must also contain abnormal data, in the same way the abnormal class also contains the normal data. So when the detection threshold is larger, the rate will be reduced and the rate of false positive decreases. When T 20% , the performance of algorithm is the best, therefore the threshold is fixed to test performance of detection of the unknown attack of proposed algorithm in this paper. Detection rate to known and unknown attack when T =20% is shown in table II. We can see that detection performance of U2R and Probing intrusion attack are better than detection performance of DoS and R2L intrusion attack. This is because there are a lot of R2L invasion disguising as legitimate user identity to attack, which makes its characteristics similar to normal packet and produces low detection rate of the algorithm. Training set contains many DoS intrusion, so intrusion data can be labeled as normal data to produce low detection rate. But overall, detection rate of unknown intrusion of the algorithm is over 50%, meaning that our proposed algorithm based on improved particle swarm and fuzzy c-means clustering can be more effective to detect the unknown intrusion behavior.
EXPERIMENT AND RESULT ANALYSIS
To evaluate the performance of the intrusion detection method based on chaos particle swarm optimization and fuzzy c-means clustering, this paper does experiment based on the KDD CUP99 dataset. The data set includes 22 kinds of attacks and 1 kind of normal type. We take 75258 records from the test set as training sample set, which contains 780 number of intrusion data. Types and number of attacks in training data set is shown in table I. In the test of sample set selection, a total of four sets of data are selected. The first set and second set of test set are from the training set and each set contains 37000 records. The third and fourth groups were selected from KDD CUP99 data set apart from the training set of data and contains 37000 records in each group. We deliberately choose intrusion data not included in training set. The third and fourth group data set contains unknown intrusion. The detection results with different threshold T is shown in Fig. 1. From experiment result, detection rate and the rate of false positive decreases with the increase of T. From experiment result, detection rate and the rate of false positive decreases with the increase of T. This is because in the detection algorithm generated clusters are ordered according to the size of data contained by clusters. So the normal data is in front and the anomaly data © 2013 ACADEMY PUBLISHER
Figure 1. The detection results with different threshold T.
Figure 2. Roc curve of dataset 1.
2546
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
alarm rate in the different conditions. So that ROC curve can exactly depict relationship between detection rate and false alarm rate of intrusion detection system. Fig. 2 is Roc curve of dataset 1, Fig. 3 is Roc curve of dataset 2, Fig. 4 is Roc curve of dataset 3, Fig. 5 is Roc curve of dataset 4. We can see that Detection rate and false alarm rate always synchronously increases or decreases. Increasing of detection rate will naturally accompanied by the rise of the rate of false positives, on the other hand, the low detection rate will surely lead to decline in the rate of false positives. So in the choice of detection rate and false alarm rate, we can take a compromise choice. V. Figure 3. Roc curve of dataset 2.
CONCLUSIONS
In this chapter clustering algorithm based on particle swarm optimization and fuzzy c-means clustering algorithm (PSO - FCM) is applied to intrusion detection. The proposed detection algorithm is simple and efficient and has fast detection speed. It is easy to realize global optimization and has good ability to detect unknown attack. Finally the KDD CUP99 dataset is used for the experiment. The results show that the algorithm improves the detection efficiency and algorithm is feasible and effective. So the algorithm should have broad application prospects in the field of intrusion detection. REFERENCES
Figure 4. Roc curve of dataset 3
Figure 5. Roc curve of dataset 4.
Now the evaluation of overall performance of intrusion detection system does not have a mature, systematic and normative evaluation model. Lincoln laboratory in the United States used ROC curve to reflect the relationship between detection rate and false positives. ROC test is widely used in evaluation of input uncertainty system and it takes false alarm rate and detection rate as abscissa and ordinate respectively according to detection rate and false
© 2013 ACADEMY PUBLISHER
[1] Xin Li, Lihong Jia, Shaojie Wang, Yuancheng Li, "A Rapid Hybrid Distributed Intrusion Detection Scheme for Large Scale Data Set", International Journal of Digital Content Technology and its Applications, 2013, Vol. 7, No. 5, pp. 287-295. [2] Liang Hu, Wenbo Wang, Kuo Zhao, "The Design and Implementation of Trusted Communication Protocol for Intrustion Prevention System", Journal of Convergence Information Technology, 2011, Vol. 6, No. 3, pp. 55-62. [3] Marjan Bahrololum, Elham Salahi, Mahmoud Khaleghi, "An Improved Intrusion Detection Technique based on two Strategies Using Decision Tree and Neural Network", Journal of Convergence Information Technology, 2009, Vol. 4, No. 4, pp. 96 -101. [4] Chang Yan, Chen Ai-dong, "A FCM Algorithm Based on Weighted Intuitionistic Fuzzy Set", International Journal of Digital Content Technology and its Applications, 2012, Vol. 6, No. 11, pp. 95-101. [5] Sheng Bin, Gengxin Sun, "An Algorithm for Detecting Community Structure of Complex Networks based on Clustering", International Journal of Digital Content Technology and its Applications, 2011, Vol. 5, No. 7, pp. 326-334. [6] Luo Shihua, Jia Li, "Silicon Content Prediction Using the Hybrid Model by Fuzzy C-means Clustering and Artificial Neural Networks", Advances in Information Sciences and Service Sciences, 2011, Vol. 3, No. 8, pp. 78-84. [7] Yunfei Ma, , Peifeng Niu, , Yantao Zhao, Xiaofei Ma, , "Adaptive Particle Swarm-Based Fuzzy Clustering Algorithm in the Application of Steam Drum Pulverized Coal Fired Boiler", International Journal of Advancements in Computing Technology, 2011, Vol. 3, No. 11, pp. 444452. [8] Chen xiao-ming, "Research on the Network Intrusion Detection Model with neural network parameters optimized by ant-colony algorithm", Journal of
JOURNAL OF NETWORKS, VOL. 8, NO. 11, NOVEMBER 2013
[9]
[10]
[11]
[12]
[13]
[14]
Convergence Information Technology, 2013, Vol. 8, No. 5, pp. 619- 627. Zhou Lu-ping, Li Bing-rong, "The study on the Intrusion Detection Algorithm Analysis using the Improved Genetic Optimized Neural Network", Journal of Convergence Information Technology, 2013, Vol. 8, No. 5, pp. 571 -577. Xiaomei YI, Peng WU, Dan DAI, Lijuan LIU, Xiong HE, "Intrusion Detection Using BP Optimized by PSO", International Journal of Advancements in Computing Technology, 2012, Vol. 4, No. 2, pp. 268-274. Xiaoqiang WANG, "Study on Genetic Algorithm Optimization for Support Vector Machine in Network Intrusion Detection", Advances in Information Sciences and Service Sciences, 2012, Vol. 4, No. 2, pp. 282-288. CHEN Zhi-xian, WANG Ru-chuan, WANG Shao-di, et al. An intrusion detection system model based on immune principle and performance analysis. The Journal of China Universities of Posts and Telecommunications, 2005, 12(1):31-35. Meijuan Gao, Jingwen Tian, Zhenbin Zhang, "A Sludge Compost Quality Evaluation Method Based on Chaos Genetic Support Vector Machine", International Journal of Digital Content Technology and its Applications, 2012, Vol. 6, No. 23, pp. 483-491. Aijun Liu, Yu Yang, Xuedong Liang, Hao Yao, "Improved Immune Genetic Algorithm Based on Hybrid Chaotic
© 2013 ACADEMY PUBLISHER
2547
[15]
[16]
[17]
[18]
[19] [20]
Maps and Its Application", Journal of Convergence Information Technology, 2012, Vol. 7, No. 1, pp. 422-432. Kuang Ling, Yiming Tan, "Application research of the plant species monitoring Internet of Things technology based on Particle Swarm with Chaotic Mutation ", Journal of Convergence Information Technology, 2012, Vol. 7, No. 11, pp. 232-238. Han Han, Houjun Wang, , "A New Method for Analog Circuit Fault Diagnosis Based on Testability and Chaos Particle Swarm Optimization", Journal of Convergence Information Technology, 2012, Vol. 7, No. 14, pp. 444-453. Shu Fan, Fengchun Tian, Qinghua He, Pengfei Jia, Jingwei Feng, Yue Shen, “Wound Infection Recognition Based on Quantum-Behaved Particle Swarm Optimization,” Journal of Convergence Information Technology, 2012, Vol. 8, No. 5, pp. 1209-1219. Youxin LUO, Xiaoyi CHE, Lingfang LI, “Chaotic Artificial Bee Colony Hybrid Discrete Constrained Optimization Algorithm,” Journal of Convergence Information Technology, 2012, Vol. 7, No. 22, pp. 484-491. J. Sun, B. Feng, W. B Xu, “Particle Swarm Optimization with Particles Having Quantum Behavior,” Proc. 2004 Congress on Evolutionary Computation, pp. 325-331. Jun Sun, Wenbo Xu, Bin Feng, “Adaptive Parameter Control for Quantum-behaved ParticleSwarm Optimization on Individual Level,” Systems, Man and Cybernetics, IEEE International Conference, 2005, 4(10-12) pp. 3049-3054.
