Abstract: Because of the absence of supervised data, classical intrusion detection system based on clustering will result in high misdetection rate and low detection rate. In view of this, we propose a method of intrusion detection based on simulated annealing and semi-supervised K-means clustering. This method improves the initial stage of clustering by using a few labeled data of network intrusion first, so the semi-supervised learn method is introduced in the K-means clustering. Then the method combines the ability of simulated annealing algorithm jumping out of the local optimal solution with semi-supervised K-means clustering to get global optimal clustering. Finally, the method identifies the clusters with labeled data and is used in the detection of intruding action. The experiment in the KDDCUP99 data set indicates that the method can improve the clustering algorithm with supervised data and simulated annealing, and obtains an increase in the precision rate of intrusion detection.

Key words:  intrusion detection, semi-supervised K-means clustering, simulated annealing