Sciweavers

TJS
2010

A novel unsupervised classification approach for network anomaly detection by k-Means clustering and ID3 decision tree learning

13 years 28 days ago
A novel unsupervised classification approach for network anomaly detection by k-Means clustering and ID3 decision tree learning
This paper presents a novel host-based combinatorial method based on k-Means clustering and ID3 decision tree learning algorithms for unsupervised classification of anomalous and normal activities in computer network ARP traffic. The k-Means clustering method is first applied to the normal training instances to partition it into k clusters using Euclidean distance similarity. An ID3 decision tree is constructed on each cluster. Anomaly scores from the k-Means clustering algorithm and decisions of the ID3 decision trees are extracted. A special algorithm is used to combine results of the two algorithms and obtain final anomaly score values. The threshold rule is applied for making decision on the test instance normality or abnormality. Experiments are performed on captured network ARP traffic. Some anomaly criteria has been defined and applied to the captured ARP traffic to generate normal training instances. Performance of the proposed approach is evaluated using five defined measures...
Yasser Yasami, Saadat Pour Mozaffari
Added 31 Jan 2011
Updated 31 Jan 2011
Type Journal
Year 2010
Where TJS
Authors Yasser Yasami, Saadat Pour Mozaffari
Comments (0)