A Novel Network Intrusion Detection Algorithm Based on Density Estimation

Data mining techniques have been successfully applied in intrusion detection because they can detect both misuse and anomaly. One of the unsupervised ways to define anomalies is by saying that anomalies are not concentrated, which depend on the density of data set. In this paper, the anomalies can be specified by choosing a reference measure ¿ which determines a density and a level value r. In order to reveal the relationship between the distribution of connection feature data sets and the reference measure ¿, we proposed a new method to design RBF classifier based on multiple granularities immune network, and apply this algorithm to estimate density level set for the data set, through which the anomaly network connections have been detected. Experimental results on the real network data set showed that the new method is competitive with others in that the false alarm rate is kept low without many missed detections.