K-Means+ID3: A Novel Method for Supervised Anomaly Detection by Cascading K-Means Clustering and ID3 Decision Tree Learning Methods

Gaddam, S.R.; Phoha, Vir V.; Balagani, Kiran S.

doi:10.1109/tkde.2007.44

Cited by 187 publications

(63 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…If this distance is less than the radius of the cluster, the new instance is attached to that cluster [Mohammadi et al, 2014] [Gaddam et al, 2007].…”

Section: Two-layer Cluster-based Structurementioning

confidence: 99%

Incremental anomaly detection using two-layer cluster-based structure

Bigdeli

Mohammadi

Raahemi

et al. 2018

Information Sciences

View full text Add to dashboard Cite

Anomaly detection algorithms face several challenges, including processing speed and dealing with noise in data. In this thesis, a two-layer clusterbased anomaly detection structure is presented which is fast, noise-resilient and incremental. In this structure, each normal pattern is considered as a cluster, and each cluster is represented using a Gaussian Mixture Model (GMM). Then, new instances are presented to the GMM to be labeled as normal or abnormal.The proposed structure comprises three main steps. In the first step, the data are clustered. The second step is to represent each cluster in a way that enables the model to classify new instances. The Summarization based on Gaussian Mixture Model (SGMM) proposed in this thesis represents each cluster as a GMM.In the third step, a two-layer structure efficiently updates clusters using In most real-time anomaly detection applications, incoming instances are often similar to previous ones. In these cases, there is no need to update clusters based on duplicates, since they have already been modeled in the cluster distribution. The two-layer structure is responsible for identifying redundant instances. In this structure, redundant instance are ignored, and the remaining new instances are used to update clusters. Ignoring redundant instances, which are typically in the majority, makes the detection phase fast.Each part of the general structure is validated in this thesis. The experiments include, detection rates, clustering goodness, time, memory usage and the complexity of the algorithms. The accuracy of the clustering and summarization of clusters using GMMs is evaluated, and compared to that of other methods. Using Davies-Bouldin (DB) and Dunn indexes, the distances for original and regenerated clusters using GMMs is almost zero with SGMM method while this value for ABACUS is around 0.01. Moreover, the results show that the SGMM algorithm is 3 times faster than ABACUS in running time, using one-third of the memory used by ABACUS.The CPL method, used to label new instances, is found to collectively remove the effect of noise, while increasing the accuracy of labeling new instances. In a noisy environment, the detection rate of the CPL method is 5% higher than other algorithms such as one-class SVM. The false alarm iii rate is decreased by 10% on average. Memory use is 20 times lesser that that of the one-class SVM.The proposed method is found to lower the false alarm rate, which is one of the basic problems for the one-class SVM. Experiments show the false alarm rate is decreased from 5% to 15% among different datasets, while the detection rate is increased from 5% to 10% in different datasets with twolayer structure. The memory usage for the two-layer structure is 20 to 50 times less than that of one-class SVM. One-class SVM uses support vectors in labeling new instances, while the labeling of the two-layer structure depends on the number of GMMs. The experiments show that the two-layer structure is 20 to 50 times faster than the one-class SVM in labelin...

show abstract

“…If this distance is less than the radius of the cluster, the new instance is attached to that cluster [Mohammadi et al, 2014] [Gaddam et al, 2007].…”

Section: Two-layer Cluster-based Structurementioning

confidence: 99%

Incremental anomaly detection using two-layer cluster-based structure

Bigdeli

Mohammadi

Raahemi

et al. 2018

Information Sciences

View full text Add to dashboard Cite

show abstract

“…Then a modified version of sliding window technique is used to estimate the damping levels associated with each identified mode. Shekhar R. Gaddam [14] developed the K-Means+ID3 pattern recognition method [14] for anomaly detection. The KMeans +ID3 method is based on cascading two well-known machine learning methods: 1) the k-Means and 2) the ID3 decision trees.…”

Section: Literature Reviewmentioning

confidence: 99%

Development of Data Mining Techniques for Data Partitioning to Generate Classification and Regression Trees.

2017

IJAERD

View full text Add to dashboard Cite

show abstract

“…And many have provided, Intrusion Detection using Fuzzy Clustering and Artificial Neural Network where it has also proved the better accuracy for using these two techniques [4] where they proved the better accuracy rate for each of the attack in the system. Some are worked for detecting novel attacks like [19,20].…”

Section: Related Workmentioning

confidence: 99%

Artificial Neural Network based System for Intrusion Detection using Clustering on Different Feature Selection

Tammi¹,

Nasim²,

Biswas³

et al. 2015

IJCA

View full text Add to dashboard Cite

Intrusion Detection System (IDS) is an example of Misuse Detection System that works for detecting malicious attacks. This can be defined as software for security management. Many researchers have proposed the Intrusion Detection System with different techniques to achieve the best accuracy. In this paper it is projected that intrusion detection system with the amalgamation of k-means clustering and artificial neural network to improve the system. To obtain a better result benchmark dataset was split into training and testing part and then cluster the dataset into five different divisions. After getting the cluster data it has been trained by the different Artificial Neural Networks functions as-Feed Forward Neural Network (FFNN), Elman Neural Network (ENN), Generalized Regression Neural Network (GRNN), Probabilistic Neural Network (PNN) and Radial Basis Neural Network (RBNN). After implementing these functions we have proposed a comparative analysis between them and choose the best accuracy rate among them. Here, it has been proved that, using the clustering technique a better accuracy rate can be found that improve the system with the best neural network functions which is the probabilistic neural network. It is also important to select efficient feature sets for better accuracy.

show abstract

K-Means+ID3: A Novel Method for Supervised Anomaly Detection by Cascading K-Means Clustering and ID3 Decision Tree Learning Methods

Cited by 187 publications

References 22 publications

Incremental anomaly detection using two-layer cluster-based structure

Incremental anomaly detection using two-layer cluster-based structure

Development of Data Mining Techniques for Data Partitioning to Generate Classification and Regression Trees.

Artificial Neural Network based System for Intrusion Detection using Clustering on Different Feature Selection

Contact Info

Product

Resources

About