A Semi-Supervised Clustering Methodology for Anomaly Based Intrusion Detection

In this paper we present a simple clustering algorithm based on a 2-means clustering anomaly detection technique and a classification tree. A set of training data consisting of normal data as well as anomalies data are divided into two clusters which are represented by their centroids. The corresponding cluster centroids are used as patterns for computationally efficient distance-based detection of anomalies in new monitoring data. Methods for clustering, training and detection are provided.? Results show that the proposed method is efficient in terms of the Dunn index. Measuring of performance are evaluated with Dunn index and C-index.