Network Anomaly Detection Based on Dynamic Hierarchical Clustering of Cross Domain Data

Cross domain data such as numerical or categorical types are ubiquitous in practical network. Network anomaly detection based on cluster analysis exist some difficulties, for example, the initial center of cluster analysis is sensitive and easy to fall into the local optimal solution. Cross domain data involved great information, but can't be effectively used, which will influence the performance of detection. In this paper, we proposed the dynamic hierarchical clustering method. Firstly, the feature selection based on information gain was used to reduce the feature dimension. Next, to measure the cross domain data, we defined the generalized Euclidean distance to extend the traditional Euclidean distance. Thirdly, dynamic clustering accuracy was set to guide the dynamic hierarchical clustering, guaranteeing the clustering accuracy as well as the convergence of clustering. Finally, Anomaly detection and classification model was constructed by using the training sample data. Simulation results show that the proposed algorithm can achieve higher detection rate and lower false detection rate.