An improved mixed-type data based kernel clustering algorithm

Clustering algorithm is often used to analyze the communication data for network intrusion detection system. However, network communication data are mixed, e.g., numerical and categorical data. So, at first, this paper put forward a method for representing the cluster center (prototype) of mixed-type data. Then respectively in combination with the continuity characteristic of the numerical attributes and the semantic feature of the categorical attributes, the dissimilarity measurement formula was improved by use of the Gauss kernel function, on the base of which, defined the objective function. After that this paper further put forward an Improved Mixed-type Data based Kernel Clustering Algorithm (IKCA-MD), which showed a stable clustering result because the initial cluster centers are obtained by Maximum Density and Distance method (MDD). Finally the feasibility and effectiveness of the method for the network intrusion detection were verified by experiments.