Abstract: In the traditional k-means algorithm, the initial cluster center is chosen randomly, clustering result varies from the initial cluster center, and clustering result is unstable. The PS(}based k-means algorithm was proposed in the paper. The PSO optimization algorithm generates the initial cluster center. The clustering result is global optimal and doesn't fall into local optimal solution. Experimental results show that the intrusion detection rate is significantly higher than the traditional k-means algorithm and its false positive rate is largely lower than the latter by applying the PSO-based k-means algorithm to the rule mining module of intrusion detection system. Obviously, the PSO-based k-means algorithm can improve the performance of network intrusion detection system effectively.

Key words: PSO-based k-means, Optimization clustering, Intrusion detection, Detection rate, False positive rate