| Download | - View accepted manuscript: An Unsupervised Clustering Algorithm for Intrusion Detection (PDF, 275 KiB)
|
|---|
| Author | Search for: Guan, Y.; Search for: Ghorbani, Ali-Akbar; Search for: Belacel, Nabil |
|---|
| Format | Text, Article |
|---|
| Conference | Advances in Artificial Intelligence, The 16th Conference of the Canadian Society for Computational Studies of Intelligence (AI 2003), June 11-13, 2003, Halifax, Nova Scotia, Canada |
|---|
| Abstract | As the Internet spreads to each corner of the world, computers are exposed to miscellaneous intrusions from the World Wide Web. Thus, we need effective intrusion detection systems to protect our computers from the intrusions. Traditional instance-based learning methods can only be used to detect known intrusions since these methods classify instances based on what they have learned. They rarely detect new intrusions since these intrusion classes has not been learned before. We expect an unsupervised algorithm to be able to detect new intrusions as well as known intrusions.<br /><br />In this paper, we propose a clustering algorithm for intrusion detection, called Y-means. This algorithm is developed based on the H-means+ algorithm [2] (an improved version of the K-means algorithm [1]) and other related clustering algorithms of K-means. Y-means is able to automatically partition a data set into a reasonable number of clusters so as to classify the instances into 'normal' clusters and 'abnormal' clusters. It overcomes two shortcomings of K-means: degeneracy and dependency on the number of clusters.<br /><br />The results of simulations that run on KDD-99 data set [3] show that Y-means is an effective method for partitioning large data set. An 89.89% detection rate and a 1.00% false alarm rate were achieved with the Y-means algorithm. |
|---|
| Publication date | 2003 |
|---|
| In | |
|---|
| Language | English |
|---|
| NRC number | NRCC 45843 |
|---|
| NPARC number | 5764311 |
|---|
| Export citation | Export as RIS |
|---|
| Report a correction | Report a correction (opens in a new tab) |
|---|
| Record identifier | 2820b823-8731-4927-a235-4050e28fe6bf |
|---|
| Record created | 2009-03-29 |
|---|
| Record modified | 2021-01-05 |
|---|
