An Adaptive k-nearest neighbor Classifier using Differential Evolution with Auto-Enhanced Population Diversity for Intrusion Detection

Abstract

Abstract Machine learning methods have attracted increasing interest in recent studies on intrusion detection. A classifier is applied to discriminate attacks from normal connections in these methods. 𝒌-nearest neighbor (𝒌NN) has been widely used in intrusion detection due to its simplicity and effectiveness. The classical 𝒌NN exploits Euclidean distance for identifying nearest neighbors, whereas how to compute the distance of data points is highly application-specific and plays a crucial role in the effectiveness of this classifier. In this paper, a novel 𝒌NN classifier is proposed that employs p-norm distance metric, the generalization of Euclidean distance, by learning p from data. The value of p in the proposed data-dependent metric is learned by the differential evolution algorithm exploiting auto-enhanced population diversity. The experimental results showed significant improvements in terms of F1 score and error rate compared to conventional kNN and Naive Bayesian classifiers on Kyoto2006+ and NSL-KDD. Furthermore, they verify the superiority of kNN classifier using the proposed data-dependent metric in terms of receiver operating characteristic curve and the corresponding area under the curve.