A cyber network attack detection based on GM Median Nearest Neighbors LDA. Issue 86 (September 2019)

• Record Type: Journal Article
• Authors: Elkhadir, Zyad; Mohammed, Benattou
• Is Part Of: Computers & security. Issue 86(2019)
• Page Start: 63
• Page End: 74
• Publication Date: 2019-09
• Subjects: Linear discriminant analysis -- Median NN-LDA -- Generalized mean -- Network anomaly detection -- Feature extraction methods -- NSL-KDD -- KDDcup99; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2019.05.021
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: The continuous development in network technologies causes a considerable hike in number of attacks and intrusions. Identification of these threats has become a critical part of security. To fulfill this task, the Intrusion Detection Systems (IDS) were created. Unfortunately, these tools have curse of dimensionality which tends to increase time complexity and decrease resource utilization. As a consequence, it is desirable that important features of network traffic must be analyzed. To obtain these features, previous work has employed a variant of Linear Discriminant Analysis (LDA) called Median Nearest Neighbors-LDA (Median NN-LDA). This approach finds the relevant features by working with network connections that are near to the median of every class. However, Median NN-LDA has an important drawback. It employs the class arithmetic mean vectors in the within and between scatter matrices formulation. As the arithmetic mean is sensitive to outliers, the approach will not produce optimal results. To deal with that, this paper introduces a new robust Median NN-LDA based on the generalized mean. Many experiments on KDDcup99 and NSL-KDD indicate the superiority of the approach over many LDA variants.