On the Use of <i>k</i>-NN in Anomaly Detection

¹ PCCW Global, Athens, Greece

² PCCW Global, Athens, Greece

³ PCCW Global, Athens, Greece

Abstract

In this paper, we describe an algorithm that uses the k -NN technology to help detect threatening behavior in a computer network or a cloud. The k -NN technology is very simple and yet very powerful. It has several disadvantages and if they are removed the k -NN can be an asset to detect malicious behavior.

Keywords&lti&gtk&lt/i&gt-NNFuzzy LogicMatching ProcessNetwork Security

Cherkassky, V. and Mulier, F. (1998) Learning from Data: Concepts, Theory, and Methods. Wiley Interscience, Hoboken.
Duda, R.O., Hart, P.E. and Stork, D.G. (2001) Pattern Classification. 2nd Edition, John Wiley & Sons, Inc., New York.
Rokach, L. and Maimon, O. (2008) Data Mining with Decision Trees: Theory and Applications. World Scientific Pub Co Inc., Singapore.
Quinlan, J.R. (1993) C4.5: Programs for Machine Learning. Morgan Kaufmann Publishers, Burlington, Massachusetts.
LeCun, Y., Bengio, Y. and Hinton, G. (2015) Deep Learning. Nature, 521, 436-444. https://doi.org/10.1038/nature14539
Figueiredo, M.A.T. and Jain, A.K. (2002) Unsupervised Learning of Finite Mixture Models. IEEE Transactions on Pattern Analysis and Machine Intelligence, 24, 381-396. https://doi.org/10.1109/34.990138
Altman, N.S. (1992) An Introduction to Kernel and Nearest-Neighbor Nonparametric Regression. The American Statistician, 46, 175-185.
Zadeh, L.A. (1965) Fuzzy Sets. Information and Control, 8, 338-353. https://doi.org/10.1016/S0019-9958(65)90241-X
Hall, P., Park, B.U. and Samworth, R.J. (2008) Choice of Neighbor Order in Nearest-Neighbor Classification. Annals of Statistics, 36, 2135-2152. https://doi.org/10.1214/07-AOS537
Samworth, R.J. (2012) Optimal Weighted Nearest Neighbour Classifiers. Annals of Statistics, 40, 2733-2763. https://doi.org/10.1214/12-AOS1049
k-Nearest Neighbors Algorithm (2017). https://en.wikipedia.org/wiki/K-nearest_neighbors_algorithm
Yihua, L. and Vemuri, V.R. (2002) Use of K-NN for Intrusion Detection. Computer & Society, 21, 439-448.

Menu

Menu

Menu

On the Use of <i>k</i>-NN in Anomaly Detection

Abstract

References (12)