Multilayer Intrusion Detection System Based on Semi-supervised Clustering

The main purpose of the intrusion detection system (IDS) is to detect a network attack and respond to the network intrusion. Existing supervised IDSs require a large amount of tag data as the training data, and there is almost no effect on the unknown attacks. Traditional unsupervised intrusion systems have problems including low accuracy and the inability to provide specific information regarding the detected attacks. To solve the above problems, we propose a multilayer IDS based on semi-supervised clustering. This system solves the problem of insufficient training data by using tag extension technology and genetic algorithm, and solves the problem of unsupervised clustering unable to provide specific information of attack by using the idea of semi-supervised clustering. We use the NSL-KDD dataset to conduct the experiments. The simulation results show that the proposed IDS only needs a small amount of training data to obtain better performance, especially for lower frequency attacks.