Abstract: In order to solve the problem that lots of redundant information existed in network intrusion detection data and the traditional clustering algorithms were inadequate for detecting outlier, an intrusion detection algorithm based on principal component analysis(PCA) and semisupervised clustering was proposed. First, the features of data were extracted by using PCA, and the redundant attributes among the data were eliminated. Then, a few labeled samples and pairwise constraints information were exploited, and competitive agglomeration was introduced to letting the system active learning in order that the detection of lots of unknown samples could be realized. The experimental results on intrusion detection data set and UCI benchmark data sets showed that this algorithm could effectively improve the system performance.

Key words: intrusion detection, principal component analysis (PCA), semisupervised clustering, pairwise constraints, competitive agglomeration