Ant Colony Optimization for Intrusion Detection System Based on KNN and KNN-DS with detection of U2R, R2L attack for Network Probe Attack Detection

The k-nearest neighbor (k-NN) is one of the most popular algorithms used for classification in various fields of pattern recognition & data mining problems. In k-nearest neighbor classification, the result of a new instance query is classified based on the majority of k-nearest neighbours. Recently researchers have begun paying attention to combining a set of individual k-NN classifiers, each using a different subset of features, with the hope of improving the overall classification accuracy. This paper describes a hybrid design for intrusion detection that combines anomaly detection with misuse detection. The proposed method includes an ensemble feature selecting classifier and a data mining classifier. The former consists of four classifiers using different sets of features and each of them employs a machine learning algorithm named fuzzy belief k-NN classification algorithm. The latter applies data mining technique to automatically extract computer users’ normal behavior from training network traffic data. The outputs of ensemble feature selecting classifier and data mining classifier are then fused together to get the final decision. The experimental results indicate that hybrid approach effectively generates a more accurate intrusion detection model on detecting both normal usages and malicious activities.