An Enhanced approach of the K-means clustering for Anomaly-based intrusion detection systems*

Abstract

The development of an anomaly-based Intrusion Detection System (IDS) is of primary importance in networks because it reinforces security. Unlike supervised methods, unsupervised methods are not widely used although they are fast and efficient. In this paper, we propose an unsupervised approach based on the K-means method to show the efficacy of these models over the supervised methods. The proposed model improves the K-means method using the Caliniski Harabasz indicator to find the appropriate number of clusters required for clustering by computing the intra-cluster to inter-cluster ratio. Above all, the proposed model is applied to two datasets, the well-known NSL-KDD and the newest CICIDS2017. The experimental results show that the proposed model exceeds largely the traditional K-means method. Additionally, it is also very efficient both in detection and time consuming compared to the SVM classifier that is a supervised classifier.