Detecting Network Intrusions ­a Clustering Approach

With the increased usage of computer networks, security becomes a critical issue. Recently, data mining methods have gained lot of attention in addressing network security issues, including intrusion detection. Consequently, unsupervised learning methods have been given much importance for anomaly based network intrusion detection. In this paper, we investigate new clustering algorithms like farthest first (FFT), hierarchical conceptual clustering (COBWEB) and Sequential Information Bottleneck Clustering (sIB) in building our proposed network intrusion detection model. We evaluated our model using KDDCup’99 intrusion detection benchmark dataset. Our research shows that the proposed clustering methods enable us to build an efficient anomaly based network intrusion detection model with high detection rate and acceptable false positive rate in comparison to other existing methods.