Unsupervised Anomaly Detection in Network Intrusion Detection Using Clusters

Most current network intrusion detection systems employ signature-based methods or data mining-based methods which rely on labelled training data. This training data is typically expensive to produce. Moreover, these methods have difficulty in detecting new types of attack. Using unsupervised anomaly detection techniques, however, the system can be trained with unlabelled data and is capable of detecting previously “unseen” attacks. In this paper, we present a new density-based and grid-based clustering algorithm that is suitable for unsupervised anomaly detection. We evaluated our methods using the 1999 KDD Cup data set. Our evaluation shows that the accuracy of our approach is close to that of existing techniques reported in the literature, and has several advantages in terms of computational complexity.

• Type: Conference
• Year: 2005
• Where: ACSC
• Authors: Kingsly Leung, Christopher Leckie
• Keywords: ACSC 2005, Computer Science, Data Mining-based Methods, Training Data, Unsupervised Anomaly Detection