CAC-UA: A Communicating Ant for Clustering to detect unknown attacks

We introduce a novel algorithm to detect unknown attacks, based on the Communicating Ant for Clustering (CAC) [1], which despite the other ants algorithm, lead to a better detection rate (DR). Secondly, having noted the low DR of R2L attacks, we improve this approach by hybridizing it with association rules approach. In addition to the measure of similarity calculated using continuous attributes of KDD(Knowledge Discovery in Databases) dataset [2], we applied also association rules on discrete attributes. These rules that are generated with the “a priori algorithm” [3] are used by ants to reach a better DR rate compared to some known intrusion detection methods. Our solution is implemented and evaluated using KDD dataset. Simulations confirm the robustness of our approach term of DR of both known and unknown attacks.