Intrusion detection with the K nearest neighbour algorithm

With the proliferation of cyber-attacks, there is an increased interest among practitioners and in academy in using Machine Learning as a defense, detection and prevention tool. In this thesis, we study the efficiency of one of the most simple and yet efficient legacy Machine Learning algorithms, namely the K-nearest-neighbour algorithm, in detecting intrusions. We investigate how different portions of training data and the value of k (i.e the number of neighbors) might affect the classification performance in three different datasets. As a benchmark dataset, we will use the KDD cup dataset, but the algorithm will also be tested on the built in IRIS dataset. The findings in the thesis demonstrate that the KNN algorithm is quite accurate in predicting attacks despite its simplicity