Classification of Network Traffic Using Fuzzy Clustering for Network Security

Abstract

The use of computer networks has increased significantly in recent years. This proliferation, in combination with the interconnection of networks via the Internet, has drastically increased their vulnerability to attack by malicious agents. The wide variety of attack modes has exacerbated the problem in detecting attacks. Many current intrusion detection systems (IDS) are unable to identify unknown or mutated attack modes or are unable to operate in a dynamic environment as is necessary with mobile networks. As a result, it has become increasingly important to find new ways to implement and manage intrusion detection systems. Classification-based IDS are commonly used, however, they are often unable to adapt to dynamic environments or to identify previously unknown attack modes. Fuzzy-based systems accommodate the imprecision associated with mutated and previously unidentified attack modes. This paper presents a novel approach to intrusion detection using fuzzy clustering of TCP packets based upon a reduced set of features. The method is shown to provide superior performance in comparison to traditional classification approaches. In addition, the method demonstrates improved robustness in comparison to other evolutionary-based techniques.