Unsupervised anomaly detection in network intrusion detection using clusters

  • Authors:
  • Kingsly Leung;Christopher Leckie

  • Affiliations:
  • The University of Melbourne, Parkville, Victoria, Australia;The University of Melbourne, Parkville, Victoria, Australia

  • Venue:
  • ACSC '05 Proceedings of the Twenty-eighth Australasian conference on Computer Science - Volume 38
  • Year:
  • 2005

Quantified Score

Hi-index 0.00

Visualization

Abstract

Most current network intrusion detection systems employ signature-based methods or data mining-based methods which rely on labelled training data. This training data is typically expensive to produce. Moreover, these methods have difficulty in detecting new types of attack. Using unsupervised anomaly detection techniques, however, the system can be trained with unlabelled data and is capable of detecting previously "unseen" attacks. In this paper, we present a new density-based and grid-based clustering algorithm that is suitable for unsupervised anomaly detection. We evaluated our methods using the 1999 KDD Cup data set. Our evaluation shows that the accuracy of our approach is close to that of existing techniques reported in the literature, and has several advantages in terms of computational complexity.