Evaluation of ACA-based Intrusion Detection Systems for Unknown-attacks

Intrusion Detection System (IDS) monitors a network and detects users’ malicious activities. Since new unknown-attacks are appearing continuously, IDS must have capability of detecting attacks without any specific prior knowledge. Also many devices are connected on network and produce enormous large volumes of network data. Labeling enormous network data manually is impractical task. Therefore, we should find a way to learn normal traffic and attack traffic by itself on the unlabeled dataset. In this paper, we propose two IDS for unknown-attacks based on Ant Clustering Algorithm (ACA). Our IDS can learn on the unlabeled dataset and detect unknown-attacks. Our proposed IDS are combination of ACA and other supervised learning algorithm. We combined Decision Tree and Artificial Neural Network with ACA separately and compared performance between them.