Supervised Anomaly Detection using Clustering-based Normal Behaviour Modeling

In this paper we present a clustering based supervised anomaly detection technique. A set of training data consisting of normal data only are divided into clusters which are represented by their profiles to form the normality model. Any deviation from the normality model is treated as attack. Methods for clustering, training and detection are provided. Our technique produces good results for KDD CUP 1999 datasets. Performance measuring methods like Recall, Precision, and F1measure for good clustering are applied. Measurings of performance are evaluated with important algorithms of ANID