A grid-based clustering for low-overhead anomaly intrusion detection

摘要: To defend a network system from security risks, intrusion detection systems (IDSs) have been playing an important role in recent years. There are two types of algorithms IDSs: misuse and anomaly detection. Because is based on signature which created the features attack traffic by experts, it can achieve accurate stable However, its weakness difficulty detecting new attacks (i.e., 0-day attack), cost maintaining latest version. Thinking increase skillful intrusion, e.g., showing similar access behavior to normal, cannot handle these critical attacks, results large number false alarms. cope with problems, we present clustering algorithm unsupervised We evaluated our using Kyoto2006+ data set KDD Cup 1999 set. Evaluation show that approach achieved higher rate region very low positive real-time preprocessing capability.