Semi-supervised learning methods for network intrusion detection

Recently increasing interests of applying or developing specialized machine learning techniques have attracted many researchers in the intrusion detection community. Existing research work show: the supervised algorithms deteriorates significantly if unknown attacks are present in the test data; the unsupervised algorithms exhibit no significant difference in performance between known and unknown attacks but their performances are not that satisfying. In this contribution, we propose two semi-supervised classification methods, spectral graph transducer and Gaussian fields approach, to detect unknown attacks and one semi-supervised clustering method-MPCK-means to improve the performances of the traditional purely unsupervised clustering methods. Our empirical study shows that performances of semi-supervised classification methods are much better than those of supervised classifiers, and semi-supervised clustering method can improve purely unsupervised clustering methods markedly.