Hybrid System for Anomaly Intrusion Detection using Enhanced K Strange Points Clustering and Naive Bayes Classifier

An intrusion detection system (IDS) monitors the system activity and tracks abnormal activity patterns thus ensuring system and file integrity. Proposed research is based on the combination of clustering and classification techniques which are used in Hybrid IDS. Clustering is a technique which groups similar data objects into a single cluster. Classification is a technique which predicts a new class for the test object. Proposed IDS works on NSL-KDD dataset. NSL-KDD dataset is a revised version of KDD99 dataset. First, clustering is performed using Enhanced K Strange Points clustering algorithm on NSL KDD consisting of Denial of Service (DoS) attacks. This output is given to the Naive bayes classifier, which classifies the dataset into 6 types of DoS attacks. The results of the proposed system are then compared with existing IDS which uses Kmeans clustering and KNN classifier. The proposed concept aims at improving the detection rates and classification rates of existing Intrusion Detection System (IDS) by using the new approach. It also focuses on reducing the false positive rates compared to the existing system.