Clustering of Network Link Characteristic for Detector Placement of Macroscopical Prewarning

Network-based and distributed intrusion detection system is aroused by the burst-outs of large-scale abnormal events. How to place detection instruments is the key to the detections. The paper turned the problem of detector placement to that of the clustering of topology graph. A novel bidirectional hierarchical clustering algorithm is put forward, which decreases the amount of result clusters by integration of initial marker selection method based on node out-degree. The simulation results demonstrate that our clustering approaches effectively by comparison on the three evaluations metric, diameter stability, average advantage ratio and average coefficient of variation