A Survey on the Use of Data Clustering for Intrusion Detection System in Cybersecurity

Abstract

In the present world, it is difficult to realize any computing application working on a standalone computing device without connecting it to the network. A large amount of data is transferred over the network from one device to another. As networking is expanding, security is becoming a major concern. Therefore, it has become important to maintain a high level of security to ensure that a safe and secure connection is established among the devices. An intrusion detection system (IDS) is therefore used to differentiate between the legitimate and illegitimate activities on the system. There are different techniques are used for detecting intrusions in the intrusion detection system. This paper presents the different clustering techniques that have been implemented by different researchers in their relevant articles. This survey was carried out on 30 papers and it presents what different datasets were used by different researchers and what evaluation metrics were used to evaluate the performance of IDS. This paper also highlights the pros and cons of each clustering technique used for IDS, which can be used as a basis for future work.

Cybersecurity attacks: Which dataset should be used to evaluate an intrusion detection system?

“…IP addresses have been pseudonymized, and their payloads and non-attack traffic have been removed from the dataset for security reasons, limiting its usability. This dataset found its application in detecting low rate stealthy as well as highrate flooding DDoS attacks (Behal & Kumar, 2016). This type of DoS attack attempts to prevent access to the targeted server by consuming Protič.…”

“…(Omar et al, 2013;Jie et al 2018). A number of authors examine, describe and compare various datasets such as ADFA-LF, ADFA-WD, AWID, CAIDA, CIC-IDS-2017, CSE-CIC-2018, DARPA 98, SCX 2012, KDD Cup '99, Kyoto 2006+, NSL-KDD and UNSW-NB15 data sets, which differ in the number of features, type of attacks and purpose (Protić, 2018;Bohara et al, 2020;Borisniya & Patel, 2015; Thakkar &…”

Wk-fnn design for detection of anomalies in the computer network traffic

“…In the last few decades, researchers have investigated the intrusion detection systems for various purposes and on the different datasets. In [11] and [12] the authors compare the DARPA98, KDD CUP '99, NSL-KDD, Kyoto 2006+ and CAIDA datasets. In addition, the authors in [13] have compared a signature-based and anomaly-based classification and examined the ISCX2012, CIC-IDS-2017 and CSE-CIC-2018 datasets in the context of the feature selection and the attack types.…”

Host Intrusion Detection System Using Novel Predefined Signature Patterns by Comparing Random Forest over Decision Tree Algorithm

“…Motive of research is focused towards predicting anomaly detection in a network environment based on numerical and categorical data to predict and improve accuracy for prediction of attacks using novel predefined signature patterns. Efficiency and importance of predicting attacks are framed to be compromised when an intrusion occurs in any protected network [1]. It is found to be important in today's world since intrusion plays a sequential role in trusted networks with a supervised intrusion detection method.…”