Network Level Anomaly Detection System Using MST Based Genetic Clustering

With the ubiquitousness and far reaching effects of Internet, the role played by Internet security systems becomes very critical. There arises an imminent need for an in force Intrusion Detection Systems (IDS). In this paper, we propose a blend of an anomaly detection system and misuse detection system. A two-phase Intrusion Detection System (IDS) involves Misuse Detection System using supervised learning techniques and Anomaly Detection System using unsupervised learning techniques. Anomalies are outliers, corresponding to attacks characterized by isolated, sparse clusters. MST based Clustering identifies the outliers by exploiting the isolation property. But in this process, some group of normal packets may be broken into sparse clusters. Our Genetic Algorithm based Optimization combines the sparse normal clusters with sufficiently close normal clusters. The resulting clusters can directly correspond to normal or anomalous types. Experimental results performed using KDD Cup 1999 dataset proved that the proposed method provides significantly high detection rates compared to other techniques.