Geometric Structure Based Feature Transformation for Network Anomaly Detection System

Due to development of new internet connected devices, the attack surface has also been increased for the cyber intruders. The evolution of theses cyber intruders poses a critical challenge for designing of detection mechanisms especially in network devices. Intrusion detection system is one such approach with the ability of detecting dynamic and unknown attacks. In this work, network anomaly detection system is developed using Mahalanobis distance-based detection mechanism with heron’s triangle area based transformed features. The KDD Cup’99 network dataset is utilized to analysis the performance of the system. It contains four different attack types such as DoS, Probe, R2L and U2R. The model has achieved very high detection rate for Normal and U2R classes with false alarm rates of 1.53% and 6.66% respectively. The detection rates are more than 99.53%, 99.7% and 98% for Probe, DoS and R2L classes along with 0.09%, 0.66% and 0.2% false alarm rates respectively.