| How to detect abnormal in the massive and dynamic changes of internet data stream is a major problem in the filed of network and is also the primary means of detecting network attacks, now more and more scholars are concerned about that.In the aspects of the network data stream, generally believe that the majority are normal behaviors, while the individual behaviors are abnormal behaviors. Based on this assumption, choose the k-means clustering algorithm to make data flow analysis, the end does not belong to any sub-cluster of data points are most likely to be outliers. K-means algorithm implementation process is that first determine the initial cluster center of k, the new data object points based on distance threshold merger to the nearest sub-cluster, finaly get the k sub-clusters of clustering results.In this paper for the shortcomings and deficiencies of k-means algorithm, for instance, sensitive to the sequence of the input data object point, easy to fall into local optimum rather than the global optimum and other issues. From two aspects to improve the original algorithm: first, according to the principle of minimum of the effectiveness function, determine the clustering results of k close to the true value, then through the implementation of the cluster center selection algorithm, select many points in high-density region, the number of data points around the point set as the weight given to the point, build min heap on the selected heap, and then proceed to heap sort, the weight value as the value of the heap nodes, one scan to determine the k-highest density of data points as the initial cluster center. The improved k-means algorithm make the criterion function faster to convergence, because instead of using the heap sort select the cluster center from the iterative calculation, time complexity is relatively low, and thus the time in the implementation of the algorithm efficiency is improved, also, because the selection of the initial cluster centers is close to the true cluster centers, in the clustering process is not easy to split large clusters, so that get the more accurate clustering results.Finally select the data sets in the UCI database and KDD99, make analysis on the improved algorithm and the original algorithm. Experimental results show that the improved algorithm in the implementation of time efficiency and accuracy of clustering results have been improved both, reduce the false positive rate of clustering results. |
