A novel unsupervised classification approach for network anomaly detection by k-Means clustering and ID3 decision tree learning

This paper presents a novel host-based combinatorial method based on k-Means clustering and ID3 decision tree learning algorithms for unsupervised classification of anomalous and normal activities in computer network ARP traffic. The k-Means clustering method is first applied to the normal training instances to partition it into k clusters using Euclidean distance similarity. An ID3 decision tree is constructed on each cluster. Anomaly scores from the k-Means clustering algorithm and decisions of the ID3 decision trees are extracted. A special algorithm is used to combine results of the two algorithms and obtain final anomaly score values. The threshold rule is applied for making decision on the test instance normality or abnormality. Experiments are performed on captured network ARP traffic. Some anomaly criteria has been defined and applied to the captured ARP traffic to generate normal training instances. Performance of the proposed approach is evaluated using five defined measures...

• Type: Journal
• Year: 2010
• Where: TJS
• Authors: Yasser Yasami, Saadat Pour Mozaffari
• Keywords: ARP Traffic, Network Arp Traffic, Normal Training Instances, TJS 2010