An anomaly intrusion detection method using the CSI-KNN algorithm
Liwei Kuang, Mohammad Zulkernine · 2008
Machine learning-based anomaly detection approaches have attracted increasing attention in the network intrusion detection community because of their intrinsic capabilities in discovering novel attacks. However, most of today's anomaly-based IDSs generate high false positive rates and miss many attacks because of a deficiency in their ability to discriminate attacks from legitimate behaviors. In this paper, we propose an anomaly intrusion detection method using the Combined Strangeness and Isolation measure K-Nearest Neighbors (CSI-KNN) algorithm. The intrusion detection algorithm analyzes different characteristics of network data by employing two measures: strangeness and isolation. Based on these measures, a correlation unit raises intrusion alerts with associated confidence estimates. Multiple CSI-KNN classifiers work in parallel to deal with different types of network services so that the CSI-KNN-based NIDS can work more efficiently than processing all network services together.