Network latency clustering for detector placement on macroscopical prewarning

Research on the network-based and distributed intrusion detection was aroused by the burst-outs of large-scale security events. How to place detection instruments was the key to the detections. The problem of detector placement was turned to that of the clustering of topology graph. A novel bidirectional hierarchical clustering algorithm was put forward, which decreased the amount of result clusters by integration of initial marker selection method based on node out-degree. The simulation results demonstrates that our clustering approaches effectively identify clusters and been employed in the measured real network of the backbone.