Nado

Anomaly detection, which is an important task in any Network Intrusion Detection System (NIDS), enables discovery of known as well as unknown attacks. Anomaly detection using outlier approach is a successful network anomaly identification technique. In this paper, we describe NADO (Network Anomaly Detection using Outlier approach), an effective outlier based approach for detection of anomalies in networks. It initially clusters the normal data using a variant of the k-means clustering technique for high dimensional data. Then it calculates the reference point from each cluster and builds profiles for each cluster. Finally, it calculates the score for each candidate point w.r.t the reference points and reports as anomaly if it exceeds a user defined threshold value. We evaluate the performance of our approach with KDDcup99 intrusion dataset and other real life datasets. We show that NADO has high detection rate and low false positive rate.