In this paper, a new algorithm has been proposed for network intrusion detection. The proposed algorithm operates in a simple but efficient manner. It uses labeled data in the training phase, which means that our algorithm is a supervised algorithm. In the training phase of the algorithm, the data are categorized based on their class label values. Then, the algorithm compute a center point for each category of the class label. A center point is a mean of all samples that belong to the same category. Finally, in the testing phase, the algorithm uses Euclidean distance metric to label the test data based on their distances to the center points. In other words, each test data assigns to the nearest center point. However, a pre-defined threshold has been used in the testing phase in order to deal with zero-day attacks. If a test data point is closer to the normal center it will be assign to the normal class but in this case the algorithm checks the pre-defined threshold. If the distance to the normal center was greater than the pre-defined threshold the test data point will be classify as an attack, else it will be assign to the normal class. Experimental results show that the proposed algorithm is superior to single Naïve Bayes classifier. The detection rate of the proposed algorithm with 95% confidence is between 95. 88 ± 0. 11 and the detection rate of Naïve Bayes algorithm with the same confidence is between 90. 03 ± 0. 31.

Data Mining Network Intrusion Detection Zero-day Attacks Identifying Supervised Learning Anomaly Detection