Improve R2L Attack Detection Using Trimmed PCA

Abstract

Due to the large growth of modern network traffic in term of size and complexity, intrusion detection systems have shown a lot of limits such as the detection rate deterioration and the rising of false positive rate. To overcome this problem, we have to eliminate the noisy content within the original high dimensional data by exploiting a feature extraction method. In literature, many publications proposed to use Principal Component Analysis (PCA). However, this method has an important limitation. The estimated general mean vector is prone to outliers. In this paper, to alleviate this issue, we suggest to exploit the trimmed mean with different percentages. Many experiments on NSL-KDD show a promising results.