Intrusion detection using clustering of network traffic flows

Abstract

This paper investigates the continued need for intrusion detection systems (IDS) in computer networks. It explores some of the ways that data mining techniques can be used to improve IDS, and looks at how others have implemented those techniques. It then highlights a method for developing an intrusion detection model using DBSCAN clustering and presents the results of the clustering algorithm as applied to a real-world data set. Finally, the paper concludes that clustering as an intrusion detection technique produces accurate results, but that special considerations must be made both with regard to outliers and the type of traffic flowing across the network.