An Efficient Mixed Attribute Outlier Detection Method for Identifying Network Intrusions

Abstract

Intrusion detection systems (IDS) play a vital role in protecting information systems from intruders. Anomaly-based IDS has established its effectiveness in identifying new and unseen attacks. It learns the normal usage pattern of a network and any event that significantly deviates from the normal behavior is signaled as an intrusion. The crucial challenge in anomaly-based IDS is to reduce false alarm rate. In this article, a clustering-based outlier detection (CBOD) approach is proposed for classifying normal and intrusive patterns. The proposed scheme operates in three modules: an improved hybrid feature selection phase that extracts the most relevant features, a training phase that learns the normal pattern in the training data by forming clusters, and a testing phase that identifies outliers in the testing data. The proposed method is applied for NSL-KDD benchmark dataset and the experimental results yielded a 97.84% detection rate (DR), a 1.88% false alarm rate (FAR), and a 97.96% classification accuracy (ACC). This proposal appears to be promising in terms of DR, FAR and ACC.