基于在线聚类和检测成本的移动自组网异常检测.pdfVIP

第 37 卷第 9 期 计算机科学 Vol. 37 No. 9 2010 年 9 月 Computer Science Sep 2010 慕于在线黯类和检测成本的移动自组网异常检测 王窗眷马传番 〈湖北大学数学与计算机科学学院 武汉 430062) 摘 要 移动自组网具有无线信 i草、动态拓扑、缺乏基础设施和节点资源受限等特点，关易受到安全威胁，Jl元法部署 复杂的安全协议和算法。为了有效检测移动自组网中的异常访问行为，提出了叩偏种基于在线聚类和检测成本的异常 悯 .J 方案丁C肌;。丁COC 先在单个节，也内对访问行为进行在线聚类和处理，然后在不同节点阅通过基于枪测成本的 协同检测进…步确认访问行为。仿真实验表明，该异常检测方案能够有效地检测移动自组网中的异常行为，且消耗资 源较少。 关键词 移动自纽阀，在线聚类.检测成本，异常检测 中回法分提号 TP391 文献标 i只码 A 伽line CIωtering 削dI刷刷 ive Cost Based Anomaly Det四tion Scheme for MANET WANG Lei-chun 如1A Chuan-xiang (Sch∞ 1 of Mathemat?cs . Computer Science. Hubei Un?vers?ty. Wuhan 430062.Chína) Abstract Mobile Ad hoc networks(MANET) are highly vulnerable to be attacked and dífficult to deploy complicated safe protocols and algorithms due to the open medium, dynamically changing network topology, lack of centralized moni? toring and rnanagement point.and linùted reωurces. To detect efficiently anomaly behaviors in MANET, this paper pro? posed a online clusteri吨 and detective cost based anornaly detection scheme for MAN盯， TCOC. In this scheme, TCOC firstly analyzes and deals with access behaviors in síngle node usíng online clustering based on access behaviors, and then valídates farther access behaviors by cooperatíve detection based on detectíve cost among different nodes. Simula? tion results show TCOCαn effíciently detect anomaly behaviors in MANET with less reωurce consumptlon. Keywords Mobile ad hoc networks. Online clustering,Detective cost, Anornaly detection