An innovative two-stage fuzzy kNN-DST classifier for unknown intrusion detection

Xueyan Jing, Yingtao Bi, Hai Deng

    Research output: Contribution to journalArticlepeer-review

    5 Scopus citations

    Abstract

    Intrusion detection is the essential part of network security in combating against illegal network access or malicious attacks. Due to constantly evolving nature of network attacks, it has been a technical challenge for an Intrusion Detection System (IDS) to recognize unknown attacks or known attacks with inadequate training data. In this work, an innovative fuzzy classifier is proposed for effectively detecting both unknown attacks and known attacks with insufficient or inaccurate training information. A Fuzzy C-Means (FCM) algorithm is firstly employed to softly compute and optimise clustering centers of the training datasets with some degree of fuzziness counting for inaccuracy and ambiguity in the training data. Subsequently, a distance-weighted k-Nearest Neighbors (k-NN) classifier, combined with the Dempster Shafer Theory (DST) is introduced to assess the belief functions and pignistic probabilities of the incoming data associated with each of known classes. Finally, a two-stage intrusion detection scheme is implemented based on the obtained pignistic probabilities and their entropy function to determine if the input data are normal, one of the known attacks or an unknown attack. The proposed intrusion detection algorithm is evaluated through the application of the KDD’99 datasets and their variants containing known and unknown attacks. The experimental results show that the new algorithm outperforms other intrusion detection algorithms and is especially effective in detecting unknown attacks.

    Original languageEnglish (US)
    Pages (from-to)359-366
    Number of pages8
    JournalInternational Arab Journal of Information Technology
    Volume13
    Issue number4
    StatePublished - Jul 1 2016

    Keywords

    • Classifiers
    • DST
    • FCM
    • Intrusion detection
    • Network security

    ASJC Scopus subject areas

    • Computer Science(all)

    Fingerprint Dive into the research topics of 'An innovative two-stage fuzzy kNN-DST classifier for unknown intrusion detection'. Together they form a unique fingerprint.

    Cite this