Efficient k‐Nearest Neighbour Approach Based on Various‐Widths Clustering

This chapter describes an unsupervised Supervisory Control and Data Acquisition (SCADA) intrusion detection system operating with unlabeled SCADA data, which is highly expected to contain abnormal data. The k‐Nearest Neighbour (k‐NN) approach is found in the literature as being the most interesting and best approach for data mining in general, and in particular it has demonstrated promising results in anomaly detection. The chapter also describes the k‐NN based on Various‐Widths Clustering (kNNVWC) approach, which efficiently finds the k‐nearest neighbors for each observation in a data set. It evaluates the performance of the kNNVWC approach on various data sets. Three aspects are considered in this evaluation: the total number of distance computations, the computational cost of the construction process, and the search for k‐NN.