An experimental study on instance selection schemes for efficient network anomaly detection

Abstract

Traditional researches on network anomaly detection have been solely focused on the detection algorithms, whereas an important issue that has not been well studied so far is the selection of normal training data for network anomaly detection algorithm, which is highly related to the detection performance and computational complexities. In this poster, we present two instance selection mechanism - EFCM (Enhanced Fuzzy C-Means) as well asGA (Genetic Algorithm) for network anomaly detection algorithm, aiming at limiting the size of training dataset, thus reducing the computational cost of them, as well as boosting their detection performance. We report our experimental results on several classic network anomaly detection algorithms by using the network traffic trace collected from a real network environment. © 2009 Springer Berlin Heidelberg.