Intrusion Detection based on K-Means Clustering and Ant Colony Optimization: A Survey
---
paper_title: High-Performance Intrusion Detection Using OptiGrid Clustering and Grid-Based Labelling

paper_content:

This research aims to construct a high-performance anomaly based intrusion detection system. Most of past studies of anomaly based IDS adopt k-means based clustering, this paper points out that the following reasons cause performance degradation of k-means based clustering when it is deployed in real traffic environment. First, k-means based algorithms have weakness for high dimensional data. Second, in spite of non-hyper spherical distribution of normal traffic in a feature space, these algorithms can only create hyper spherical clusters. Furthermore, unsophisticated algorithms to label clusters cannot achieve high detection performance. In order to solve these issues, this paper proposes a modification of OptiGrid clustering and a cluster labelling algorithm using grids. OptiGrid has robust ability to high dimensional data. Our labelling algorithm divides the feature space into grids and labels clusters using the density of grids. The combination of these two algorithms enables a system to extract the feature of traffic data and classifies the data as attack or normal correctly. We have implemented our system and confirmed efficiency of our system by utilizing both KDDCUP1999 data sets and Kyoto 2006+ data sets.
---
paper_title: Using a Dynamic K-means Algorithm to Detect Anomaly Activities

paper_content:

IDS (Intrusion Detection system) is an active and driving defense technology. This paper mainly focuses on intrusion detection based on clustering analysis. The aim is to improve the detection rate and decrease the false alarm rate. A modified dynamic K-means algorithm called MDKM to detect anomaly activities is proposed and corresponding simulation experiments are presented. Firstly, the MDKM algorithm filters the noise and isolated points on the data set. Secondly by calculating the distances between all sample data points, we obtain the high-density parameters and cluster-partition parameters, using dynamic iterative process we get the k clustering center accurately, then an anomaly detection model is presented. This paper used KDD CUP 1999 data set to test the performance of the model. The results show the system has a higher detection rate and a lower false alarm rate, it achieves expectant aim.
---
paper_title: Intrusion detection based on K-Means clustering and Naïve Bayes classification

paper_content:

Intrusion Detection System (IDS) plays an effective way to achieve higher security in detecting malicious activities for a couple of years. Anomaly detection is one of intrusion detection system. Current anomaly detection is often associated with high false alarm with moderate accuracy and detection rates when it's unable to detect all types of attacks correctly. To overcome this problem, we propose an hybrid learning approach through combination of K-Means clustering and Naive Bayes classification. The proposed approach will be cluster all data into the corresponding group before applying a classifier for classification purpose. An experiment is carried out to evaluate the performance of the proposed approach using KDD Cup'99 dataset. Result show that the proposed approach performed better in term of accuracy, detection rate with reasonable false alarm rate.
---
paper_title: Network programming and mining classifier for intrusion detection using probability classification

paper_content:

In conventional network security simply relies on mathematical algorithms and low counter measures to taken to prevent intrusion detection system, although most of this approaches in terms of theoretically challenged to implement. Therefore, a variety of algorithms have been committed to this challenge. Instead of generating large number of rules the evolution optimization techniques like Genetic Network Programming (GNP) can be used. The GNP is based on directed graph, In this paper the security issues related to deploy a data mining-based IDS in a real time environment is focused upon. We generalize the problem of GNP with association rule mining and propose a fuzzy weighted association rule mining with GNP framework suitable for both continuous and discrete attributes. Our proposal follows an Apriori algorithm based fuzzy WAR and GNP and avoids pre and post processing thus eliminating the extra steps during rules generation. This method can sufficient to evaluate misuse and anomaly detection. Experiments on KDD99Cup and DARPA98 data show the high detection rate and accuracy compared with other conventional method.
---
paper_title: Anomaly Intrusion Detection Method Based on K-Means Clustering Algorithm with Particle Swarm Optimization

paper_content:

K-means clustering algorithm is an effective method that has been proved for apply to the intrusion detection system. Particle swarm optimization (PSO) algorithm which is evolutionary computation technology based on swarm intelligence has good global search ability. With the deficiency of global search ability for K-means clustering algorithm, we propose a K-means clustering algorithm based on particle swarm optimization (PSO-KM) in this paper. The proposed algorithm has overcome falling into local minima and has relatively good overall convergence. Experiments on data sets KDD CUP 99 has shown the effectiveness of the proposed method and also shows the method has higher detection rate and lower false detection rate.
---
paper_title: Intrusion detection based on K-Means clustering and Naïve Bayes classification

paper_content:

Intrusion Detection System (IDS) plays an effective way to achieve higher security in detecting malicious activities for a couple of years. Anomaly detection is one of intrusion detection system. Current anomaly detection is often associated with high false alarm with moderate accuracy and detection rates when it's unable to detect all types of attacks correctly. To overcome this problem, we propose an hybrid learning approach through combination of K-Means clustering and Naive Bayes classification. The proposed approach will be cluster all data into the corresponding group before applying a classifier for classification purpose. An experiment is carried out to evaluate the performance of the proposed approach using KDD Cup'99 dataset. Result show that the proposed approach performed better in term of accuracy, detection rate with reasonable false alarm rate.
---
paper_title: Ant Algorithms for Discrete Optimization

paper_content:

This article presents an overview of recent work on ant algorithms, that is, algorithms for discrete optimization that took inspiration from the observation of ant colonies' foraging behavior, and introduces the ant colony optimization (ACO) metaheuristic. In the first part of the article the basic biological findings on real ants are reviewed and their artificial counterparts as well as the ACO metaheuristic are defined. In the second part of the article a number of applications of ACO algorithms to combinatorial optimization and routing in communications networks are described. We conclude with a discussion of related work and of some of the most important aspects of the ACO metaheuristic.
---
paper_title: Intrusion detection based on K-Means clustering and Naïve Bayes classification

paper_content:

Intrusion Detection System (IDS) plays an effective way to achieve higher security in detecting malicious activities for a couple of years. Anomaly detection is one of intrusion detection system. Current anomaly detection is often associated with high false alarm with moderate accuracy and detection rates when it's unable to detect all types of attacks correctly. To overcome this problem, we propose an hybrid learning approach through combination of K-Means clustering and Naive Bayes classification. The proposed approach will be cluster all data into the corresponding group before applying a classifier for classification purpose. An experiment is carried out to evaluate the performance of the proposed approach using KDD Cup'99 dataset. Result show that the proposed approach performed better in term of accuracy, detection rate with reasonable false alarm rate.
---
paper_title: Intrusion detection based on K-Means clustering and Naïve Bayes classification

paper_content:

Intrusion Detection System (IDS) plays an effective way to achieve higher security in detecting malicious activities for a couple of years. Anomaly detection is one of intrusion detection system. Current anomaly detection is often associated with high false alarm with moderate accuracy and detection rates when it's unable to detect all types of attacks correctly. To overcome this problem, we propose an hybrid learning approach through combination of K-Means clustering and Naive Bayes classification. The proposed approach will be cluster all data into the corresponding group before applying a classifier for classification purpose. An experiment is carried out to evaluate the performance of the proposed approach using KDD Cup'99 dataset. Result show that the proposed approach performed better in term of accuracy, detection rate with reasonable false alarm rate.
---
paper_title: MINING LUNG CANCER DATA AND OTHER DISEASES DATA USING DATA MINING TECHNIQUES: A SURVEY

paper_content:

If you think about the dangerous diseases in the world then you always list Cancer as one. Lung cancer is one of the most dangerous cancer types in the world. These diseases can spread by uncontrolled cell growth in tissues of the lung. Early detection can save the life and survivability of the patients. In this paper we survey several aspects of data mining which is used for lung cancer prediction. Data mining is useful in lung cancer classification. We also survey the aspects of ant colony optimization (ACO) technique. Ant colony optimization helps in increasing or decreasing the disease prediction value. This study assorted data mining and ant colony optimization techniques for appropriate rule generation and classification, which pilot to exact cancer classification. In addition to, it provides basic framework for further improvement in medical diagnosis.
---
paper_title: Extraction of Significant Patterns from Heart Disease Warehouses for Heart Attack Prediction

paper_content:

Summary The diagnosis of diseases is a significant and tedious task in medicine. The detection of heart disease from various factors or symptoms is a multi-layered issue which is not free from false presumptions often accompanied by unpredictable effects. Thus the effort to utilize knowledge and experience of numerous specialists and clinical screening data of patients collected in databases to facilitate the diagnosis process is considered a valuable option. The healthcare industry gathers enormous amounts of heart disease data that regrettably, are not “mined” to determine concealed information for effective decision making by healthcare practitioners. In this paper, we have proposed an efficient approach for the extraction of significant patterns from the heart disease warehouses for heart attack prediction. Initially, the data warehouse is preprocessed to make it appropriate for the mining process. After preprocessing, the heart disease warehouse is clustered using the K-means clustering algorithm, which will extract the data relevant to heart attack from the warehouse. Subsequently the frequent patterns are mined from the extracted data, relevant to heart disease, using the MAFIA algorithm. Then the significant weightage of the frequent patterns are calculated. Further, the patterns significant to heart attack prediction are chosen based on the calculated significant weightage. These significant patterns can be used in the development of heart attack prediction system.
---
paper_title: A multiagent system using associate rule mining (ARM), a Collaborative filtering approach

paper_content:

Agent Oriented Programming (AOP) is a recent promising software paradigm that brings concepts from the theories of artificial intelligence into the mainstream realm of distributed systems, and yet it is rather difficult to find a successful application of agent oriented system (specifically) when large-scale systems are considered. When adopting an agent-oriented approach to solve a problem, there are a number of domain independent issues that must always be solved, such as how to model agent behavior to predict future action and how to allow agents to communicate rather than expecting developers to develop this core infrastructure themselves. In our paper, we address several problems that exist in a socialized e-learning environment and provide solutions to these problems through smart and collaborative agent behavior modeling which learn and adapt themselves through prior experiences, thereby assisting in successful implementation of this large scale e-learning system. In this paper, the author (s) proposes an implementation of a complete distributed e-learning system based on Collaborative filtering (CF) method. The system has intelligent collaborative filtering based tutoring system (ICFTS) capabilities that allow contents, presentation and navigation to be adapted according to the learner's requirements. In order to achieve that development, two concepts were put together: multi-agent systems and data mining techniques (specifically, the ARM algorithm). All the implementation code is developed using MATLAB GUI environment. To our best knowledge, very few literatures discusses a portion of e-learning environment using adaptive software agents, but none of the current literatures addresses a complete implementation of their learning system in detail. The goal of the paper is to implement one such multi-agent based e-learning system which learns from its prior user experiences on top of an agent-oriented middleware that provides the domain-independent infrastructure, allowing the developers to focus on building the key logic behind it. In this system, the agents follow an adaptive cognitive learning approach, where the agent learns through user behaviors via a collaborative filtering technique, or experiencing and then processing and remembering the information in an e-learning environment. The paper will utilize agent (a piece of code) based environment in our e-learning system using ARM [1][2]. The paper follows a learning approach based cognitive domain of Bloom's Taxonomy such as Analyze, Evaluate, Create, Apply, understand and remember.
---
paper_title: Probable Sequence Determination Using Incremental Association Rule Mining and Transaction Clustering

paper_content:

Many organizations collect information about customers which are used to support various business related task. The detail of the customers and their behavior is stored in the database. Here we propose a method of using incremental updating technique to mine direct association rules Inter & Intra transactions. Cluster analysis is performed to verify the associated objects fall in nominal cluster. The result of this technique can be used to develop well structured e-shop which facilitate the customer by helping him to find what he wants in a specialized way and also aids him to choose the associated products by the method of prediction. Thus it reduces the workload of marketing professional to provide direct marketing and thereby providing customer satisfaction.
---
paper_title: Apriori and Ant Colony Optimization of Association Rules

paper_content:

Association Rule mining is one of the important and most popular data mining technique. Association rule mining can be efficiently used in any decision making processor decision based rule generation. In this paper we present an efficient mining based optimization techniques for rule generation. By using apriori algorithm we find the positive and negative association rules. Then we apply ant colony optimization algorithm (ACO) for optimizing the association rules. Our results show the effectiveness of our approach.
---
paper_title: A formal immune network and its implementation for on-line intrusion detection

paper_content:

This paper presents a mathematical model of immune network specified for real-time intrusion detection. A software implementation of the model has been tested on data simulating a typical US Air Force local area network (LAN). The obtained results suggest that the performance of the model is unachievable for other approaches of computational intelligence. A hardware implementation of the model is proposed based on digital signal processor (DSP) of super Harvard architecture (SHARC).
---
paper_title: Intrusion detection based on K-Means clustering and Naïve Bayes classification

paper_content:

Intrusion Detection System (IDS) plays an effective way to achieve higher security in detecting malicious activities for a couple of years. Anomaly detection is one of intrusion detection system. Current anomaly detection is often associated with high false alarm with moderate accuracy and detection rates when it's unable to detect all types of attacks correctly. To overcome this problem, we propose an hybrid learning approach through combination of K-Means clustering and Naive Bayes classification. The proposed approach will be cluster all data into the corresponding group before applying a classifier for classification purpose. An experiment is carried out to evaluate the performance of the proposed approach using KDD Cup'99 dataset. Result show that the proposed approach performed better in term of accuracy, detection rate with reasonable false alarm rate.
---

Title: Intrusion Detection based on K-Means Clustering and Ant Colony Optimization: A Survey

Section 1: Literature Survey
Description 1: This section discusses the various research works on intrusion detection, including the methods and results reported by different authors.

Section 2: Problem Domain
Description 2: This section identifies the gaps and challenges in traditional intrusion detection approaches, highlighting the need for improved hybrid systems.

Section 3: Analysis
Description 3: This section provides a comparative analysis of different research works to identify the areas where detection mechanisms perform weakly.

Section 4: Optimized Association
Description 4: This section explains the role of association rule mining in detecting patterns, how it can be optimized, and its applications in different sectors.

Section 5: Proposed Work
Description 5: This section describes the proposed approach for intrusion detection using K-Means clustering combined with Ant Colony Optimization, including an illustrative example and methodology.

Section 6: Conclusion and Future Work
Description 6: This section summarizes the findings, discusses the advantages and disadvantages of various techniques, and proposes future research directions for enhancing intrusion detection systems.