Unsupervised anomaly detection in network intrusion detection using clusters

摘要: Most current network intrusion detection systems employ signature-based methods or data mining-based which rely on labelled training data. This is typically expensive to produce. Moreover, these have difficulty in detecting new types of attack. Using unsupervised anomaly techniques, however, the system can be trained with unlabelled and capable previously "unseen" attacks. In this paper, we present a density-based grid-based clustering algorithm that suitable for detection. We evaluated our using 1999 KDD Cup set. Our evaluation shows accuracy approach close existing techniques reported literature, has several advantages terms computational complexity.