Mining Network Security Logs via Fuzzy Clustering Algorithm

This paper concentrates on the problem of mining network security logs, which is very important to maintain the secure network environment. Firstly, we illustrate the structure of the network security logs mining system, which is made up of three modules: (1) data pre-processing module, (2) pattern mining module and (3) pattern analysis module. Secondly, we define the vector of user session and user transaction. As fuzzy clustering may fall into local minima, we introduce the fuzzy particle swarm optimization to promote the performance of fuzzy clustering, and then we proposed a hybrid fuzzy particle swarm optimization and fuzzy clustering to mining useful information from network security logs. Finally, we conduct experiments based on Iris dataset and IBM Power System S824L. Experimental results demonstrate that compared with HCM, FCM, and SFCM, our proposed algorithm can achieve high clustering accuracy with lower time cost.