Unsupervised Anomaly Detection Based on Clustering and Multiple One-Class SVM

摘要: Intrusion detection system (IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it is unable detect unknown attacks, i.e., 0-day the ultimate challenge in intrusion field how we can exactly identify such attack by automated manner. Over past few years, several studies on solving these problems have been made anomaly using unsupervised learning techniques clustering, one-class support vector machine (SVM), etc. Although they enable one construct models at low cost and effort, capability unforeseen still mainly two detection: rate high false positive rate. In this paper, propose new method based clustering multiple SVM order improve while maintaining We evaluated KDD Cup 1999 data set. Evaluation results show that approach outperforms existing algorithms reported literature; especially of