A Novel Outlier Detection Scheme for Network Intrusion Detection Systems

Network intrusion detection system serves as a second line of defense to intrusion prevention. Anomaly detection approach is important in order to detect new attacks. Outlier detection scheme is one of the most successful anomaly detection approaches. In this paper, we propose a novel outlier detection scheme based on cost-distribution to detect anomaly behavior in network intrusion detection. We evaluate the capability of this new approach with the data set from KDD Cup 1999 data mining competition. The results indicate that the cost-distribution based scheme outperforms current outlier anomaly detection approaches in the capability to detect attacks and low false alarm rate.