A clustering-based method for unsupervised intrusion detections

Detection of intrusion attacks is an important issue in network security. This paper considers the outlier factor of clusters for measuring the deviation degree of a cluster. A novel method is proposed to compute the cluster radius threshold. The data classification is performed by an improved nearest neighbor (INN) method. A powerful clustering-based method is presented for the unsupervised intrusion detection (CBUID). The time complexity of CBUID is linear with the size of dataset and the number of attributes. The experiments demonstrate that our method outperforms the existing methods in terms of accuracy and detecting unknown intrusions. (c) 2005 Elsevier B.V. All rights reserved.