A Hybrid Intrusion Detection Algorithm Based on Gaussian Mixture Model and Nearest Neighbors

Hybrid learning approaches prove to be superior to single technologies in the field of intrusion detection. Moreover, the representative feature is a determinant of generating accurate signatures and improving detection performance. In this paper, we propose a hybrid intrusion detection algorithm based on Gaussian Mixture Model (GMM) and k-Nearest Neighbors (k-NN). More specifically, we first implement GMM to characterize the spatial distribution of each category. Then, a novel GMM-based data formation method is performed to extract distance and density features, called GMDD. By sufficiently utilizing the classification information contained in the original data, GMDD constructs concise and high-quality characteristics. Finally, k-NN is trained and tested on newly transformed datasets to build the detection model. The experimental results on KDD’99 and NSL-KDD datasets indicate that the proposed method not only outperforms other recent studies in terms of accuracy, detection rate and false alarm rate, but also provides excellent computational efficiency.