FHNN: A Resampling Method for Intrusion Detection

To improve the data processing speed of intrusion detection system, this paper focused on how to select representative samples from network data sets. Several resampling methods were discussed in this paper. The novel algorithm, Fast Hierarchical Nearest Neighbor (FHNN) outperformed NCL method in experiments with KDD'99 datasets. Taking the two-stage strategy with load balancing model for high-speed network intrusion detection system (HNIDS), we split the training dataset by the protocol and build the patterns for each dataset. Experimental results show that FHNN is faster than other methods and it is very efficient in tacking noise from majority class examples.