Performance Comparison of K-Means and Expectation-Maximization Clustering Algorithms for Network Intrusion Detection

Abstract

The tremendous growth of networks and internet-based services have led to more numerous and complicated cyberattacks. Organizations today widely adopt networks for many things; like sending messages, transferring money, data storing, and using internet for communication and cloud computing. Therefore, networks are the attractive targets for the cyber-attacks and require protective mechanisms. Firewalls, antivirus program, and access controls provide the preventative means, but they are only enough for new attacks or simple kinds of attacks, they cannot provide any protection to sophisticated or newly discovered kinds of attacks. Intrusion detection systems are an unavoidable system for a cybersecurity environment, since they continuously monitor network traffic and detect malicious activity that the prevention mechanisms miss out. Machine learning methods have gained a considerable success at the field of network intrusion detection since they can analyse and learn patterns from network traffic, unlike rule-based systems, they do not require predefined signature of attacks. There are two types of machine learning algorithms, supervised learning and unsupervised learning. Unsupervised learning is more efficient for network intrusion detection and particularly Clustering as a type of unsupervised learning is used since it can help in partitioning the network traffic into various types of connection with identifying the anomalous connection without using the pre-labelled intrusion training data. The most popular methods in clustering are the K-means algorithm for its high calculation efficiency and ease of implementation, while expectation-maximization (EM) algorithms provide probabilistic model based-clustering which can model more complex kind of data. Only very few research has compared the two types of clustering, K-Means and EM algorithms for network intrusion detection system under exactly the same experimental settings and the same common dataset, The present study outlines the comparative analysis of K-Means and Expectation-Maximization clustering algorithms towards network intrusion detection through applying on the KDD Cup 1999 benchmark dataset. Experiments is setup using WEKA data mining tool for having a consistent research environment. Comparison research based on the computationally performance, clustering patterns, converging behaviours, and the execution efficiency in general manner. Data for network traffic is pre-processed and then the two clustering algorithms are analysed using exactly same parameters where appropriate. Comparison metrics for two algorithms includes the runtime, distribution patterns across clusters, speed of convergence, and clustering validity. The primary research intention is to assess the strengths and weakness of the K-means and EM algorithms for an unsupervised detection of intrusions, thus providing a guide for an appropriate clustering technique for large networks information security system.