A Novel Classification via Clustering Method for Anomaly Based Network Intrusion Detection System

Intrusion detection in the internet is an active area of research. Intruders can be classified into two types, namely; external intruders who are unauthorized users of the computers they attack, and internal intruders, who have permission to access the system but with some restrictions. The aim of this paper is to present a methodology to recognize attacks during the normal activities in a system. A novel classification via sequential information bottleneck (sIB) clustering algorithm has been proposed to build an efficient anomaly based network intrusion detection model. We have compared our proposed method with other clustering algorithms like X-Means, Farthest First, Filtered clusters, DBSCAN, K-Means, and EM (ExpectationMaximization) clustering in order to find the suitability of our proposed algorithm. A subset of KDDCup 1999 intrusion detection benchmark dataset has been used for the experiment. Results show that the proposed method is efficient in terms of detection accuracy, low false positive rate in comparison to the other existing methods.