An Intrusion Detection Method Based on Damped Window of Data Stream Clustering

According to the characteristics of network data, such as fast stream, large and infinite, an intrusion detection method DDCstream based on damped window of data stream clustering is proposed. This method uses the framework of two-layer to divide the process into the online layer and the offline layer. The combination of clusters by Secondary clustering can accelerate the online clustering quickly, and the attenuation factor can adaptively obtain the latest attack data. The experimental results show that the method can effectively find the attack behavior and update the abnormal intrusion detection rule base in the face of dynamic network data, so as to improve the detection rate of unknown attack data.