A Misuse and Anomaly Intrusion Detection System Using Hybrid Supervised and Unsupervised Data Mining Approaches

Abstract

Intrusion Detection Systems (IDSs) play a crucial role in monitoring computer network security. Data mining and machine learning techniques facilitate the identification of intrusion patterns within large volumes of data. Hybrid data mining models have become increasingly popular in IDSs due to their enhanced effectiveness. This study presents a novel hybrid IDS that combines misuse and anomaly detection by integrating supervised, unsupervised, and outlier detection methods from data mining, implemented in three phases. First, data pre-processing techniques are applied to prepare the dataset. Second, the K-means clustering algorithm is used for cluster profiling. Next, association rule mining and outlier detection techniques characterize normal and attack patterns. Third, various classical and ensemble learning algorithms are employed to classify the patterns in the dataset. Evaluating the proposed model using the NSL-KDD dataset demonstrates its superior performance compared to previous studies. The model employs the association rule mining algorithm to generate valuable if-then patterns for both misuse and anomaly detection. Additionally, it utilizes classic and ensemble supervised machine learning methods to classify attack and normal records within the IDS. Ultimately, the proposed model uncovers and characterizes hidden intrusion patterns, thereby enhancing the overall effectiveness of IDSs.