Incremental Clustering Algorithm for Intrusion Detection Using Clonal Selection

A computing cluster radius method is given, and the data is partitioned into initial clusters by comparing the distance from data to cluster centroid with the size of cluster radius. To implement clustering analysis about data with mixed attributes, namely numerical attributes and categorical attributes, the definitions of distance measure and objective function are improved. By applying clonal selection algorithm to optimize the clustering results, the problems such as computing dissimilarity for data with mixed attributes and finally unknown cluster number and easy to fall into local optimization are solved, and better clustering results are obtained. The experiment results show that the presented incremental clustering algorithm for intrusion detection can achieve high detection rate and low false positive rate.