Hybrid Intrusion Detection System Using K-Means Algorithm - Dagly, Darshan K; Gori, Rohan V; Kamath, Rohan R; Sharma, Deepak H (International Journal of Computer Sciences and Engineering, 2025)
Today in the age of computers and internet, identity theft, data theft, privacy and confidentiality infringement are some of the major issues faced by organizations as well as individuals. Network and System Security can be provided with the help of firewalls and Intrusion Detection Systems. An Intrusion Detection System (IDS) investigates all incoming and outgoing network traffic to identify malicious behavior that may pose a threat to the confidentiality, integrity or availability of a network or a system. IDS can be signature-detection (misuse) based or anomaly detection based. Misuse detection technique can be used to detect only known attacks whereas anomaly detection can be used to detect novel attacks (Unknown Attacks).This paper focuses on Hybrid Intrusion Detection System which combines both Misuse and Anomaly Detection modules. Various data mining techniques have been developed and implemented to be used with Intrusion Detection Systems. We use K-Means Clustering Algorithm to cluster and classify the incoming data into normal and anomalous connections. Clustering is an unsupervised learning technique for finding patterns in collection of unsupervised data. Prototype testing shows that K-Means algorithm can be successfully used to detect unknown attacks in real live data.