Predicting Intrusion in a Network Traffic Using Variance of Neighboring Object’s Distance

Abstract

Activities in network traffic can be broadly classified into two categories: normal and malicious. Malicious activities are harmful and their detection is necessary for security reasons. The intrusion detection process monitors network traffic to identify malicious activities in the system. Any algorithm that divides objects into two categories, such as good or bad, is a binary class predictor or binary classifier. In this paper, we utilized the Nearest Neighbor Distance Variance (NNDV) classifier for the prediction of intrusion. NNDV is a binary class predictor and uses the concept of variance on the distance between objects. We used KDD CUP-99 dataset to evaluate the NNDV and compared the predictive accuracy of NNDV with that of the KNN or K-Nearest Neighbor classifier. KNN is an efficient general-purpose classifier, but we only considered its binary aspect. The results are quite satisfactory to show that NNDV is comparable to KNN. Many times, the performance of NNDV is better than KNN. We experimented with normalized and unnormalized data for NNDV and found that the accuracy results are generally better for normalized data. We also compared the accuracy results of different cross-validation techniques such as 2-fold, 5-fold, 10-fold, and leave-one-out on the NNDV for the KDD CUP-99 dataset. Cross-validation results can be helpful in determining the parameters of the algorithm.