Determining the Optimum Number of Clusters with K-Means Algorithm and Silhouette Metric in Intrusion Detection Systems

Fatih Topaloğlu

Makale detayları

Determining the Optimum Number of Clusters with K-Means Algorithm and Silhouette Metric in Intrusion Detection Systems

Yazarlar:

Fatih Topaloğlu

Yayıncı:

Gazi University

Ana Başlıklar:

Yarı ve Denetimsiz Öğrenme

Dergi:

Bilişim Teknolojileri Dergisi Vol.17 Issue 2, pp.71-79

Belge Tipi:

Makale

Yayın Tarihi:

4/2024

Belge Dili:

Türkçe

Document ID (Org No.):

2001316476

pISSN:

1307-9697

Anahtar kelimeler:

Özet:

 TTodays internet consists of almost half a million different networks. In a network connection, it is difficult to identify attacks by type. Because different attacks can have various connections and their number can vary from a few network connections to hundreds of network connections. For this reason, it becomes difficult to correctly classify the data sets used for attack detection. The main motivation of the study is to overcome the challenges of high dimensionality in intrusion detection systems and improve classification performance, ultimately providing more accurate and efficient detection of intrusions. In the past, many researchers have developed intrusion detection systems to detect intruders using different methods. However, existing methods have some disadvantages in terms of detection accuracy and time loss. In the study, it was aimed to analyze the KDD Cup99 attack detection data set according to different k values with the k-means clustering algorithm and to determine the optimum number of clusters with the silhouette metric. In the analysis carried out for different k values in the study, the silhouette score was calculated for each possible configuration up to k  10. According to this metric, the best number of clusters was found to be 4 and the silhouette score was 0.83. Additionally, silhouette graphic thicknesses and cluster sizes are visualized.

 TTodays internet consists of almost half a million different networks. In a network connection, it is difficult to identify attacks by type. Because different attacks can have various connections and their number can vary from a few network connections to hundreds of network connections. For this reason, it becomes difficult to correctly classify the data sets used for attack detection. The main motivation of the study is to overcome the challenges of high dimensionality in intrusion detection systems and improve classification performance, ultimately providing more accurate and efficient detection of intrusions. In the past, many researchers have developed intrusion detection systems to detect intruders using different methods. However, existing methods have some disadvantages in terms of detection accuracy and time loss. In the study, it was aimed to analyze the KDD Cup99 attack detection data set according to different k values with the k-means clustering algorithm and to determine the optimum number of clusters with the silhouette metric. In the analysis carried out for different k values in the study, the silhouette score was calculated for each possible configuration up to k  10. According to this metric, the best number of clusters was found to be 4 and the silhouette score was 0.83. Additionally, silhouette graphic thicknesses and cluster sizes are visualized.

 TTodays internet consists of almost half a million different networks. In a network connection, it is difficult to identify attacks by type. Because different attacks can have various connections and their number can vary from a few network connections to hundreds of network connections. For this reason, it becomes difficult to correctly classify the data sets used for attack detection. The main motivation of the study is to overcome the challenges of high dimensionality in intrusion detection systems and improve classification performance, ultimately providing more accurate and efficient detection of intrusions. In the past, many researchers have developed intrusion detection systems to detect intruders using different methods. However, existing methods have some disadvantages in terms of detection accuracy and time loss. In the study, it was aimed to analyze the KDD Cup99 attack detection data set according to different k values with the k-means clustering algorithm and to determine the optimum number of clusters with the silhouette metric. In the analysis carried out for different k values in the study, the silhouette score was calculated for each possible configuration up to k  10. According to this metric, the best number of clusters was found to be 4 and the silhouette score was 0.83. Additionally, silhouette graphic thicknesses and cluster sizes are visualized.

 Günümüz internetleri neredeyse yarım milyon farklı ağdan oluşmaktadır. Bir ağ bağlantısında, saldırıları türlerine göre tanımlamak zordur. Çünkü farklı saldırılar çeşitli bağlantılara sahip olabilir ve sayıları birkaç ağ bağlantısından yüzlerce ağ bağlantısına kadar değişebilmektedir. Bu nedenden dolayı saldırı tespiti için kullanılan veri setlerinin doğru sınıflandırılması zorlaşmaktadır. Geçmişte pek çok araştırmacı, farklı yöntemler kullanarak davetsiz misafirleri tespit etmek için saldırı tespit sistemleri geliştirmiştir. Ancak mevcut yöntemlerin tespit doğruluğu ve zaman kaybı açısından bazı dezavantajları bulunmaktadır. Çalışmanın temel motivasyonu, saldırı tespit sistemlerinde yüksek boyutluluğun getirdiği zorlukların üstesinden gelmek ve sınıflandırma performansını geliştirmek, sonuçta izinsiz girişlerin daha doğru ve verimli tespitini sağlamaktır. Çalışmada KDD Cup99 saldırı tespiti veri setinin k-means kümeleme algoritması ile farklı k değerlerine göre analiz edilmesi ve silhouette metriği ile optimum küme sayısının belirlenmesi amaçlanmıştır. Çalışmada farklı k değerleri için yapılan analizlerde, k10a kadar olası her konfigürasyon için silhouette skoru hesaplanmıştır. Bu metriğe göre en iyi küme sayısı 4 ve silhouette skoru 0.83 olarak bulunmuştur. Ayrıca silhouette grafiği kalınlıkları ile küme boyutları görselleştirilmiştir.

Makale detayları

Determining the Optimum Number of Clusters with K-Means Algorithm and Silhouette Metric in Intrusion Detection Systems

Yazarlar:

Fatih Topaloğlu

Yayıncı:

Gazi University

Ana Başlıklar:

Yarı ve Denetimsiz Öğrenme

Dergi:

Bilişim Teknolojileri Dergisi Vol.17 Issue 2, pp.71-79

Belge Tipi:

Makale

Yayın Tarihi:

4/2024

Belge Dili:

Türkçe

Document ID (Org No.):

2001316476

pISSN:

1307-9697

Intrusion detection system

k-means

silhouette metricSaldırı tespit sistemleri

k-means

silhouette metriği

Sayı

Makale detayları

Determining the Optimum Number of Clusters with K-Means Algorithm and Silhouette Metric in Intrusion Detection Systems

Yazarlar: Fatih Topaloğlu

Yayıncı: Gazi University

Ana Başlıklar: Yarı ve Denetimsiz Öğrenme

Dergi: Bilişim Teknolojileri Dergisi Vol.17 Issue 2, pp.71-79

Belge Tipi: Makale

Yayın Tarihi: 4/2024

Belge Dili: Türkçe

Document ID (Org No.): 2001316476

pISSN: 1307-9697

Intrusion detection system

k-means

silhouette metricSaldırı tespit sistemleri

k-means

silhouette metriği

Sayı

Yazarlar:

Fatih Topaloğlu

Yayıncı:

Gazi University

Ana Başlıklar:

Yarı ve Denetimsiz Öğrenme

Dergi:

Bilişim Teknolojileri Dergisi Vol.17 Issue 2, pp.71-79

Belge Tipi:

Makale

Yayın Tarihi:

4/2024

Belge Dili:

Türkçe

Document ID (Org No.):

2001316476

pISSN:

1307-9697