Abstract:

As data streams show the fast, unlimited and bursting characteristics, real-time intrusion detection in high-speed networks becomes a problem. A similarity search cluster-tree (SSC-tree) is designed to maintain the summary feature of data streams and a clustering algorithm based on the SSC-tree is proposed to detect intrusion in highspeed networks. In order to process high speed and bursting streams in time, chaining buffer, piggyback and local cluster mechanisms are used. The chaining buffer in SSC-tree is used to store temporary data stream objects which are piggybacked later to solve the problem that high-speed streams cannot be clustered in time when the bursting data streams arrive. Besides, in order to meet the arrival of high-speed stream, the algorithm introduces a local cluster mechanism, which is the process of preclustering to produce local micro-clusters before data stream objects are inserted in the SSC-tree. The experiment results show that the proposed algorithm has good applicability and high clustering accuracy in high-speed networks. It can detect the intrusion in high-speed networks effectively.