Fuzzified Cuckoo based Clustering Technique for Network Anomaly Detection. (October 2018)

• Record Type: Journal Article
• Authors: Garg, Sahil; Batra, Shalini
• Is Part Of: Computers & electrical engineering. Volume 71(2018)
• Page Start: 798
• Page End: 817
• Publication Date: 2018-10
• Subjects: Anomaly detection -- Feature selection -- Decision Tree -- Nature inspired algorithm -- Cuckoo-search -- K-means clustering -- Fuzzy theory; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2017.07.008
• Languages: English
• ISSNs: 0045-7906

Abstract

Highlights: A robust anomaly detection technique, i.e., Fuzzified Cuckoo based Clustering Technique (F-CBCT) is proposed that operates in two phases, i.e., training and detection. Decision-Tree based approach is applied in the training phase to select the most informative features from the dataset. A combination of Cuckoo Search Optimization and K-means clustering is employed to evaluate two simultaneous distance functions, i.e., C-Measure and AD-Measure. Fuzzy decisive approach is used in the detection phase where the system is left free to detect the anomalies on the basis of input data and computed distance functions. Performance evaluation results in terms of detection rate, false positive rate and accuracy on different datasets validate the effectiveness of the proposed model. Abstract: With the increasing penetration of security threats, the severity of their impact on the underlying network has increased manifold. Hence, a robust anomaly detection technique, Fuzzified Cuckoo based Clustering Technique (F-CBCT), is proposed in this paper which operates in two phases: training and detection. The training phase is supported using Decision Tree followed by an algorithm based on hybridization of Cuckoo Search Optimization and K-means clustering. In the designed algorithm, a multi-objective function based on Mean Square Error and Silhouette Index is employed to evaluate the two simultaneous distance functions namely-Classification measure and Anomaly detection measure. Once the system is trained, detection phase is initiated in which a fuzzy decisive approach is used to detect anomalies on the basis of input data and distance functions computed in the previous phase. Experimental results in terms of detection rate (96.86%), false positive rate (1.297%), accuracy (97.77%) and F-Measure (98.30%) prove the effectiveness of the proposed model.