Unsupervised Anomaly Based Network Intrusion Detection Using Farthest First and Hierarchical Conceptual Clustering.

Abstract

With the increased usage of computer networks, security becomes a critical issue. Recently, data mining methods have gained lot of attention in addressing network security issues, including intrusion detection. Consequently, unsupervised learning methods have been given much importance for anomaly based network intrusion detection. In this paper, we investigate new clustering algorithms like farthest first and hierarchical conceptual clustering (COBWEB) in building our proposed network intrusion detection model. We evaluated our model using KDDCup’99 intrusion detection benchmark dataset. Our research shows that the proposed clustering methods with five class classifications enable us to build an efficient anomaly based network intrusion detection model with high detection rate and acceptable false positive rate in comparison to other existing methods in detecting rare attacks.