A Rough-Fuzzy Hybrid Algorithm for Computer Intrusion Detection

In this paper, we propose an intrusion detection method that combines rough sets theory and fuzzy c-means for anomaly detection. The first step consists of attribute selection which is based on rough set theory for each of the 5 classes of intrusions in the Defense Advanced Research Projects Agency (DARPA) data is identified. The next phase is clustering by using fuzzy c-means; we are using rough sets for cleaning and to filtering out redundant, spurious information. Fuzzy c-means allow objects to belong to several clusters simultaneously, with different degrees of membership. Our method is an accurate model for handling complex attack patterns in large networks. We used data set from 1999 Knowledge Discovery and Data mining (KDD) intrusion detection contest. The main goal of this paper is to apply this method to increase the efficiency of a given intrusion detection model and to be able to reduce the data set by looking for overlapping categories and also to filter in the desired ones.