Combination of R1-PCA and median LDA for anomaly network detection

Anomaly intrusion detection models play a crucial role in identifying zero day attacks that occur in the computer or networks. However they suffer from many functional issues such as high false alarm rate and low detection rate. That arises, in large part, due to manipulating huge traffic data with many outliers. To overcome that, many machine learning techniques were widely employed. This paper proposes a novel method which combine two reduction dimension algorithms, namely Rotational Invariant L1-norm Principal Component Analysis (R1-PCA) and median Linear Discriminant Analysis (median LDA). This technique alleviates the effect of outliers firstly by using L1-norm instead of the PCAs classical euclidean norm. Secondly, in LDA stage, we use the class median vector to estimate the class mean vector. We conduct extensive experiments on KDDcup99 to verify the efficacy of the proposed method and corroborate the above claims.