A NOVEL COST METRIC EVALUATION METHOD FOR ANOMALY DETECTION

In this paper we present “A Novel clustering algorithm” which is a partition based clustering algorithm that works well for data with mixed numeric and categorical features for classifying anomalous and normal activities in a computer network. The proposed method first partitions the training instances into k-clusters using dissimilarity measurement. On each cluster representing a density region of normal or anomaly instances we apply either of the two rules 1.Threshold rule 2. Bayes decision rule to obtain a final decision. We report our results of applying k-prototype clustering algorithm to the extensively gathered network audit data for the 1998 DARPA intrusion detection evaluation program