Anomaly Intrusion Detection System Using Gaussian Mixture Model

Intrusion detection systems have been widely used to overcome security threats in computer networks and to identify unauthorized use, misuse, and abuse of computer systems. Anomaly-based approaches in intrusion detection systems have the advantage of being able to detect unknown attacks; they look for patterns that deviate from the normal behavior. We have proposed an approach of anomaly intrusion detection system by using Gaussian mixture model. This method learns patterns of normal and intrusive activities to classify that use a set of Gaussian probability distribution functions. The use of maximum likelihood in detection phase has used the deviation between current and reference behavior. GMM is evaluated by dataset KDD99 without any special hardware requirements. Experimental results show that this method is able to reducing the missing alarm. Moreover, this model is a fast method for detecting the unknown attacks.