Intrusion Detection using a Novel Hybrid Method Incorporating an Improved KNN

Abstract

These days, with the tremendous growth of network-based service and shared information on networks, the risk of network attacks and intrusions increases too, therefore network security and protecting the network is getting more significance than before. Intrusion Detection System (IDS) is one of the solutions to detect attacks and anomalies in the network. The ever rising new intrusion or attack types causes difficulties for their detection, therefore Data mining techniques has been widely applied in network intrusion detection systems for extracting useful knowledge from large number of network data to detect intrusions. Many clustering and classification algorithms are used in IDS, therefore improving the functionality of these algorithms will improve IDS performance. This paper focuses on improving KNN classifier in existing intrusion detection task which combines K-MEANS clustering and KNN classification.

Intrusion Detection System for Healthcare Systems Using Medical and Network Data: A Comparison Study

“…In [17], Bilge et al use Indexed Partial Distance Search k-Nearest Neighbor (IKPDS) to test different types of attacks, and it results in an accuracy of 99.6%. Shapoorifard and Shamsinejad in [18] focus on reducing the false alarm rate and show an accuracy of 85.2% [18]. These two approaches use an enhanced version of the KDD dataset but still suffer from the same problems and differences we mentioned earlier with the original KDD dataset.…”

“…The authors of [17,18] use the KNN method as a basis for their cybersecurity methods. In [17], Bilge et al use Indexed Partial Distance Search k-Nearest Neighbor (IKPDS) to test different types of attacks, and it results in an accuracy of 99.6%.…”

BAT: Deep Learning Methods on Network Intrusion Detection Using NSL-KDD Dataset

“…Experimental results on NSL-KDD cup 99 of intrusion detection data set showed that the classification accuracy of this method with all training features reached 99%. In [19], the authors combine k-mean clustering on the basis of KNN classifier. The experimental results on NSL-KDD dataset show that this method greatly improves the performance of KNN classifier.…”

“…b i is the i-th feature in a data packet, and x represents a continuous features of data packet. These features include basic features (1-10), content features (11)(12)(13)(14)(15)(16)(17)(18)(19)(20)(21)(22) and traffic features (23-41) [50]. According to its characteristics, there are four types of attacks in this dataset: DoS (Denial of Service attacks), R2L (Root to Local attacks), U2R (User to Root attack), and Probe (Probing attacks).…”

Intrusion Detection of Imbalanced Network Traffic Based on Machine Learning and Deep Learning

“…Pervez proposed a new method for feature selection and classification merging of multi-class NSL-KDD Cup99 dataset using Support Vector Machine(SVM) and discussed the classification accuracy of classifiers under different dimension features [12]. Shiraz studied some new technologies to improve CANN intrusion detection methods' classification performance and evaluated their performance on the NSL-KDD Cup99 dataset [13]. He used the K Farthest Neighbor(KFN) and the K Nearest Neighbor(KNN) to classify the data and used the Second Nearest Neighbor(SNN) of the data when the nearest and farthest neighbors have the same class label.…”