Nonlinear l2,p-norm based PCA for Anomaly Network Detection

Abstract

Intrusion detection systems are well known for their ability to detect internal and external intrusions, it usually recognizes intrusions through learning the normal behaviour of users or the normal traffic of activities in the network. So, if any suspicious activity or behaviour is detected, it informs the users of the network. Nonetheless, intrusion detection system is usually prone to a high false positive rate & a low detection rate as a consequence of the tremendous amount of meaningless information used in the network traffic utilized to create the intrusion detection system. To overcome that, many techniques like Principal Component Analysis (PCA), L 1 -PCA and 2,p -norm based PCA were suggested. However, these methods are linear and not robust to outliers. This paper introduces the nonlinear variant of the 2,p -norm principal component analysis. Namely, the nonlinear 2,p -norm principal component analysis intends to project the data sets into a more feasible form so that the meaning of the data is damaged as less as possible. The proposed technique is not uniquely robust to outliers but keeps PCA's positive properties as well. Experimental results on the datasets KDDCup99 and NSL-KDD show that the proposed technique is extra effective, robust and outperform PCA, L 1 -PCA and 2,p -norm based PCA algorithms.