Fuzzy mega cluster based anomaly network intrusion detection
Neminath Hubballi, Santosh Biswas, Sukumar Nandi · 2009
Most of the anomaly based techniques produce vast number of alert messages that include a large percentage of false alarms. One of the widely used technique for anomaly intrusion detection systems (IDS) is cluster analysis. In cluster based IDS, feature vectors generated from network traffic are grouped into clusters as normal or abnormal (raising alert). The main cause for false alert generation is either, technique fails to differentiate an outlier from a genuine cluster point or the features extracted fail to separate the two classes. In this work, fuzzy clustering technique for anomaly intrusion detection has been explored to reduce the false alarms. A technique to robustify the existing fuzzy c-means algorithm is proposed and subsequently used as anomaly IDS.