Exploring the Similarity/Dissimilarity measures for unsupervised IDS

Abstract

This paper investigates various Similarity/Dissimilarity measures for Intrusion Detection Problem. In this paper we implemented an offline Anomaly based IDS using agglomerative and partition based clustering algorithms with selected Similarity/Dissimilarity measures. In unsupervised learning labeling the clusters is an important task. This paper employed two cluster labeling algorithms, SNC labeling algorithm and “labeling clusters using class representative objects”. This work is evaluated using KDDCup 99 dataset.