CANN: An intrusion detection system based on combining cluster centers and nearest neighbors

摘要: Abstract The aim of an intrusion detection systems (IDS) is to detect various types malicious network traffic and computer usage, which cannot be detected by a conventional firewall. Many IDS have been developed based on machine learning techniques. Specifically, advanced approaches created combining or integrating multiple techniques shown better performance than general single feature representation method important pattern classifier that facilitates correct classifications, however, there very few related studies focusing how extract more representative features for normal connections effective attacks. This paper proposes novel approach, namely the cluster center nearest neighbor (CANN) approach. In this two distances are measured summed, first one distance between each data sample its center, second in same cluster. Then, new one-dimensional used represent k-Nearest Neighbor (k-NN) classifier. experimental results KDD-Cup 99 dataset show CANN not only performs similar k-NN support vector machines trained tested original terms classification accuracy, rates, false alarms. I also provides high computational efficiency time training testing (i.e., detection).