Comparative study between fuzzy C-Means algorithm and artificial immune network algorithm in intrusion detection system

Abstract

Intrusion Detection Systems (IDS) is special software developed in order to protect the system against security threats and malware. IDS provides second line of defense after rule based firewall. Unfortunately IDS with supervised learning approach heavily rely on labeled training data and generally it fails to detect novel attacks and produces high false alarm. Besides, data labeling is expensive and time consuming. However, a systematic method which offers the capability to alleviate this problem is through the use of unsupervised approaches, which is the basis for this research. In addition to that, to investigate this phenomenon, a comparison between two clustering algorithms based on an anomaly detection system IDS is proposed. Related literature has given a direction towards comparing two clustering algorithm which are Artificial Immune Network (AIN) and Fuzzy c-means (FCM). The performance of those two clustering algorithm were measured based on false positive rate, false negative rate, hit rate and detection. This study has evaluated and analyzed AIN and FCM clustering algorithms. The finding shows that AIN gives higher overall accuracy and hit rate. It also gives lower false alarms on both datasets used in the study. Consistent good performances of AIN in clustering network traffic data into respective classes has made AIN a promising clustering technique to be of used in detection novel attack traffic in IDS.