Search

With the development of the networks, the security of computer networks is becoming more and more serious. The information openness, sharing and interconnection are three important characteristics of computer networks. However, the amounts of intruders and attackers have been grows with the popularization of computers. Therefore, the focus of network security is preventing systems from being invaded effectively. Intrusion detection as a key technology of network security active defense system is designed to distinguish normal behaviors and attack behaviors. Intrusion detection is divided into misuse detection and anomaly detection, and using clustering algorithm is one of the most effective methods for anomaly detection. In this paper, a clustering algorithm based on fast search and find of density peaks is used to distinguish the normal and abnormal network connections to achieve the purpose of anomaly detection. The performance of the algorithm is tested by a data set selected from KDD CUP99. Experiment results show that this algorithm is more suitable than the traditional K-means in data sets containing a large amount of data and uneven density distribution.

With the rapid development of the Internet, the application of data mining in the Internet is becoming more and more extensive. However, the data source’s complex feature redundancy leads that data mining process becomes very inefficient and complex. So feature selection research is essential to make data mining more efficient and simple. In this paper, we propose a new way to measure the correlation degree of internal features of dataset which is a mutation of mutual information. Additionally we also introduce Hoeffding inequality as constraint of constructing algorithm. During the experiments, we use C4.5 classification algorithm as test algorithm and compare HSF with BIF(feature selection algorithm based on mutual information). Experiments results show that HSF performances better than BIF[1] in TP and FP rate, what’s more the feature subset obtained by HSF can significantly improve the TP, FP and memory usage of C4.5 classification algorithm.

Botnet have turned into the most serious security dangers on the present Internet framework. A botnet is most extensive and regularly happens in today's cyber-attacks, bringing about the serious risk of our system resources and association's properties. Botnets are accumulations of compromised computers (Bots) which are remotely regulated by its creator (BotMaster) under a typical Command-and-Control (C&C) framework. Botnets cannot just be implemented utilizing existing well-known applications and additionally developed by unknown or inventive applications. This makes the botnet detection a challenging issue. In this paper proposed an anomaly detection model based on genetic neural network system, which joined the significant global searching capability of genetic algorithm with the precise local searching element of back propagation feed forward neural networks to improve the initial weights of neural network.