K-Nearest-Neighbours with a novel similarity measure for intrusion detection

K-Nearest-Neighbours is one of the simplest yet effective classification methods. The core computation behind it is to calculate the distance from a query point to all of its neighbours and to choose the closest one. The Euclidean distance is the most frequent choice, although other distances are sometimes required. This paper explores a simple yet effective similarity definition within Nearest Neighbours for intrusion detection applications. This novel similarity rule is fast to compute and achieves a very satisfactory performance on the intrusion detection benchmark data sets tested.