基于文本挖掘的漏洞信息聚类分析
Clustering analysis of vulnerability information based on text mining

为了挖掘漏洞内在联系且高效管理漏洞信息,将文本处理和聚类算法应用于漏洞挖掘中.从漏洞库宏观角度出发,提出了一种基于文本挖掘和粒子群优化算法的漏洞信息聚类(PSO-K-means)算法.首先,通过文本处理,获取频词空间,用以将漏洞信息描述字段编码化;其次,为了减少局部最优和聚类中心选取不当对聚类结果的影响,利用粒子群优化算法获取全局聚类中心;最后,利用K-means算法实现漏洞信息的聚类,对漏洞信息进行分类别管理,并为预测未知漏洞特征提供参考.实验结果表明,PSO-K-means算法准确率达到90.16%,与K-means算法相比,其平均准确率提高约5%,平均迭代次数减少约45次.所提算法可预测3种未知漏洞的主要类别,是一种有效的漏洞分析方法.
In order to dig out the internal relationships of vulnerability and efficiently manage vulnerability information, text processing and clustering algorithm are applied to vulnerability mining. In the aspect of whole vulnerability database, the PSO-K-means algorithm based on text mining and particle swarm optimization(PSO)algorithm is proposed. First, the keyword space is obtained by text processing to code the vulnerability information description. Secondly, the PSO algorithm is used to obtain the global cluster centers for reducing the impact of local optimum and cluster centers’ improper selection on clustering. Finally, the K-means algorithm is adopted to achieve clustering of vulnerability information, which can administer vulnerability information in classification and supply information for predicting unknown vulnerability characteristics. The experimental results show that the accuracy rate of the PSO-K-means algorithm is 90.16%. Compared to the K-means algorithm, the average accuracy rate of the PSO-K-means algorithm is increased by about 5% and the average number of iteration is reduced about 45 times. Moreover, the PSO-K-means algorithm can predict three primary classes for unknown vulnerability and it is an effective vulnerability analysis method