A Literature Survey and Comprehensive Study of Intrusion Detection <s> K-means algorithm based intrusion detection <s> As the Internet spreads to each comer of the world, computers are exposed to miscellaneous intrusions from the World Wide Web. We need effective intrusion detection systems to protect our computers from these unauthorized or malicious actions. Traditional instance-based learning methods for intrusion detection can only detect known intrusions since these methods classify instances based on what they have learned. They rarely detect the intrusions that they have not learned before. In this paper, we present a clustering heuristic for intrusion detection, called Y-means. This proposed heuristic is based on the K-means algorithm and other related clustering algorithms. It overcomes two shortcomings of K-means: number of clusters dependency and degeneracy. The result of simulations run on the KDD-99 data set shows that Y-means is an effective method for partitioning large data space. A detection rate of 89.89% and a false alarm rate of 1.00% are achieved with Y-means. <s> BIB001 </s> A Literature Survey and Comprehensive Study of Intrusion Detection <s> K-means algorithm based intrusion detection <s> In the present work, we propose a new technique to enhance the learning capabilities and reduce the computation intensity of a competitive learning multi-layered neural network using the K-means clustering algorithm. The proposed model use multi-layered network architecture with a backpropagation learning mechanism. The K-means algorithm is first applied to the training dataset to reduce the amount of samples to be presented to the neural network, by automatically selecting an optimal set of samples. The obtained results demonstrate that the proposed technique performs exceptionally in terms of both accuracy and computation time when applied to the KDD99 dataset compared to a standard learning schema that use the full dataset.. <s> BIB002
In this section, we discuss the different papers that utilize k-means algorithm. In 2003-2004 some papers presented to represent the K-means algorithm based intrusion detection. Some of the papers have been discussed below. In the year 2003, a K-means based clustering algorithm, named Y-means, for incursion detection has been offered by Yu Guan et al. BIB001 . Y-means surmounts two failings of K-means: quantity of clusters dependency and degeneracy. The original number of clusters was no longer serious to the collecting results in the Y-means algorithm. A suitable number of clusters were divided by a data set routinely. This was one of the benefits of the Y-means algorithm for intrusion detection. The unprocessed log data of information systems can directly be applied as training data with-out being physically labeled was the another advantage. In the very next year 2004, using the K-means clustering algorithm a technique have built up by K. M. Faraoun and A. Boukelif BIB002 to improve the learning capacities and decrease the computation strength of a competitive learning multi-layered neural network. Through a back propagation learning means the recommended model used multi-layered network structural design. To decrease the amount of examples to be offered to the neural network, the K-means algorithm was initially used to the training dataset by automatically choosing a most favorable set of samples. The acquired results showed that the suggested technique executes specially in terms of both precision and computation time when pertained to the KDD99 dataset match up to a normal learning schema that utilized the full dataset.