KCMC: A Hybrid Learning Approach for Network Intrusion Detection using K-means Clustering and Multiple Classifiers

Abstract

A network Intrusion Detection System (IDS) is a security tool that acts as a defensive line. One of the most important challenges in network intrusion detection research area is designing an accurate intrusion detection system in terms of high detection rate, high accuracy and low false alarm rate. Hybrid learning approaches employ to deal with this challenge since, they have promising results in terms of detection rate, accuracy and false alarm rate. This paper, proposed a general structure of a hybrid learning approach. Then, the proposed approach has been implemented using Kmeans Clustering and Multiple Classifiers (KCMC). The data have been partitioned based on K-means clustering algorithm. Then, each partition classified using a distinct classifier. Naïve Bayes, Support Vector Machines and OneR classification algorithms have been used as the classifiers. The proposed hybrid approach has better results comparing to single classifiers in terms of detection rate, accuracy and false alarm rate. The detection rate of the proposed hybrid learning approach is 99.50%.

Security detection of network intrusion: application of cluster analysis method

“…The general model of intrusion detection is shown in Fig. 1, which contains two main intrusion detection methods: misuse detection and anomaly detection [8]. The process of misuse detection in the model in Fig.…”