Anomaly Based Intrusion Detection Systems in Computer Networks: Feedforward Neural Networks and Nearest Neighbor Models as Binary Classifiers

Abstract

Anomaly based intrusion detection systems monitor the computer network traffic and compare the unknown network behavior with the statistical model of the normal network behavior. The anomaly detection is mainly based on binary classification. Machine learning models are common tools for determining the normality of the network behavior. Binary classifiers like feedforward neural network and the nearest neighbor models have proven to be the best classification option in terms of both processing time and the accuracy when the instances were normalized and the features selected to reduce the data. The results of the experiments carried on the six daily records from the Kyoto 2006+ dataset show the apparent decrease in accuracy of ~ 1% for a number of instances greater than ~ 100,000 per day.