Performance Evaluation of Geometric Area Analysis Technique for Anomaly Detection Using Trapezoidal Area Estimation

Computer network technology is developing quickly, and the advancement of internet techniques is growing faster. Furthermore, people and companies have became more aware of the importance of network security. To protect the network from different attacks, it is necessary to instantly detect intrusions with significantly low False-Positive Rates (FPRs). Many Anomaly-based Detection Systems (ADS) have been proposed in the past. The performance of these systems depends on many factors such as features selection or extraction, missing or inaccurate records in data, over-fitting, under-fitting, high bias, and variance in data. Thus, it is important to take all these factors into account. Recently, a novel Geometric Area Analysis (GAA) technique based on Trapezoidal Area Estimation (TAE) has been proposed based on the Beta Mixture Model (BMM). In this work, we evaluate GAA and TAE techniques using other flexible mixture models based on inverted Beta, generalized Dirichlet, and generalized inverted Dirichlet distributions. The evaluation of this work is performed on two datasets, namely the NSL-KDD and UNSW-NB15. The results have shown the efficiency of the proposed ADS demonstrated by obtaining high accuracy and low false-positive rates in all attack types.