Enhancing kNN-Based Intrusion Detection with Differential Evolution with Auto-Enhanced Population Diversity

Effective intrusion detection is crucial for ensuring the security of computer networks. Machine learning methods, particularly the k-nearest neighbor (kNN) classifier, have shown promising results in detecting attacks. However, the effectiveness of the kNN classifier depends on the distance metric used to identify nearest neighbors, which is highly application-specific. In this paper, a novel kNN classifier is developed that employs p-norm distance metric, the generalization of Euclidean distance, by learning p from data. The value of p in the proposed data-dependent metric is learned by the differential evolution algorithm exploiting auto-enhanced population diversity. The experimental results showed significant improvements in terms of F1 score and error rate compared to conventional kNN and Naive Bayesian classifiers on Kyoto2006+ and NSL-KDD. Furthermore, they verify the superiority of kNN classifier using the proposed data-dependent metric in terms of receiver operating characteristic curve and the corresponding area under the curve.