Abstract A new clusters labelling strategy, which combines the computation of the Davies-Bouldin index of the clustering and the centroid diameters of the clusters is proposed for application in anomaly based intrusion detection systems (IDS). The aim of such a strategy is to detect compact clusters containing very similar vectors and these are highly likely to be attack vectors. Experimental results comparing the effectiveness of a multiple classifier IDS with such a labelling strategy and that of the classical cardinality labelling based IDS show that the proposed strategy behaves much better in a heavily
Petrovic et al. REF introduced a new cluster labeling techniques for attacks identification based on combination of Davies-Bouldin index of clustering and centroid diameter evaluation.
Labelling Clusters in an Intrusion Detection System Using a Combination of Clustering Evaluation Techniques
Proceedings of the 39th Annual Hawaii International Conference on System Sciences (HICSS'06)
Proceedings of the 39th Annual Hawaii International Conference on System Sciences (HICSS'06)
Computer Science