Unsupervised anomaly detection in network intrusion detection using clusters

TLDR

Current intrusion detection systems rely on labeled data, which is costly to produce and struggle to detect novel attacks. The study introduces a density‑ and grid‑based clustering algorithm for unsupervised anomaly detection in network intrusion detection. The algorithm was evaluated on the 1999 KDD Cup dataset. Results show accuracy comparable to existing methods while offering lower computational complexity.

Abstract

Most current network intrusion detection systems employ signature-based methods or data mining-based methods which rely on labelled training data. This training data is typically expensive to produce. Moreover, these methods have difficulty in detecting new types of attack. Using unsupervised anomaly detection techniques, however, the system can be trained with unlabelled data and is capable of detecting previously unseen attacks. In this paper, we present a new density-based and grid-based clustering algorithm that is suitable for unsupervised anomaly detection. We evaluated our methods using the 1999 KDD Cup data set. Our evaluation shows that the accuracy of our approach is close to that of existing techniques reported in the literature, and has several advantages in terms of computational complexity.