Applying an Improved DBSCAN Clustering Algorithm to Network Intrusion Detection

Density-Based Spatial Clustering of Application with Noise (DBSCAN) is a typical density clustering algorithm, which defines a cluster as the maximum set of densities connected points. It can divide regions with sufficient density of clusters, and can find clusters of any shape of the spatial database with noise. However, the data types it can deal with are limited, and the clustering quality is poor when the density of the sample set is not uniform and the clustering distance difference is large. To solve these problems, an improved DBSCAN algorithm based on K-prototypes and dissimilarity matrix is proposed to improve the quality of clustering and applied to network intrusion detection. The experimental results show that, the proposed algorithm improves the clustering quality of the KDD Cup 99 dataset for network intrusion detection.