A Novel Fuzzy Anomaly Detection Method Based on Clonal Selection Clustering Algorithm
This paper presents a novel unsupervised fuzzy clustering method based on clonal selection algorithm for anomaly intrusion detection in order to solve the problem of fuzzy k-means algorithm which is particularly sensitive to initialization and fall easily into local optimization. This method can quickly obtain the global optimal clustering with a clonal operator which combines evolutionary search, global search, stochastic search and local search, then detect abnormal network behavioral patterns with a fuzzy detection algorithm. Simulation results on the data set KDD CUP99 show that this method can efficiently detect unknown intrusions with lower false positive rate and higher detection rate.
KeywordsIntrusion Detection Fuzzy Cluster Anomaly Detection Intrusion Detection System Lower False Positive Rate
Unable to display preview. Download preview PDF.
- 2.Sugbae, C., Sangjun, H.: Two Sophisticated Techniques to Improved HMM-Based Intrusion Detection Systems. In: Proceeding of RAID, Pittsburgh, September 2003, pp. 207–219 (2003)Google Scholar
- 3.He, D., Leung, H.: CFAR Intrusion Detection Method Based on Support Vector Machine Prediction. In: Proceeding of CIMSA 2004, Boston, July 2004, pp. 10–15 (2004)Google Scholar
- 4.Jeme, N.K.: Towards a Network Theory of the Immune System. Ann. Immunol., 373–389 (January 1974)Google Scholar
- 6.Jie, L., Xinbo, G., Licheng, J.: A Novel Clustering Method with Network Structure Based on Clonal Algorithm. In: Proceedings of ICASSP 2004, Canada, May 2004, pp. 793–796 (2004)Google Scholar
- 7.Portnoy, L., Eskin, E., Stolfo, S.: Intrusion Detection with Unlabeled Data Using Clustering. In: Proceedings of DMSA 2001, Philadelphia, November 2001, pp. 5–8 (2001)Google Scholar
- 8.KDD CUP 1999 Data Set (1999), http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html