A nature-inspired approach to speed up optimum-path forest clustering and its application to intrusion detection in computer networks

•A new meta-heuristic optimization approach to speed up Optimum-Path Forest clustering.•Intrusion detection in computer networks by means of Optimum-Path Forest clustering.•Comparison of several meta-heuristics for Optimum-Path Forest optimization. We propose a nature-inspired approach to estimate t...

Full description

Saved in:
Bibliographic Details
Published in:Information sciences 2015-02, Vol.294, p.95-108
Main Authors: Costa, Kelton A.P., Pereira, Luis A.M., Nakamura, Rodrigo Y.M., Pereira, Clayton R., Papa, João P., Xavier Falcão, Alexandre
Format: Article
Language:English
Subjects:
Clustering
Computer information security
Computer networks
Forests
Graphs
Intrusion
Intrusion detection
Meta-heuristic
Optimum-path forest
Probability density functions
Roots
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:•A new meta-heuristic optimization approach to speed up Optimum-Path Forest clustering.•Intrusion detection in computer networks by means of Optimum-Path Forest clustering.•Comparison of several meta-heuristics for Optimum-Path Forest optimization. We propose a nature-inspired approach to estimate the probability density function (pdf) used for data clustering based on the optimum-path forest algorithm (OPFC). OPFC interprets a dataset as a graph, whose nodes are the samples and each sample is connected to its k-nearest neighbors in a given feature space (a k-nn graph). The nodes of the graph are weighted by their pdf values and the pdf is computed based on the distances between the samples and their k-nearest neighbors. Once the k-nn graph is defined, OPFC finds one sample (root) at each maximum of the pdf and propagates one optimum-path tree (cluster) from each root to the remaining samples of its dome. Clustering effectiveness will depend on the pdf estimation, and the proposed approach efficiently computes the best value of k for a given application. We validate our approach in the context of intrusion detection in computer networks. First, we compare OPFC with data clustering based on k-means, and self-organization maps. Second, we evaluate several metaheuristic techniques to find the best value of k.
ISSN:0020-0255
1872-6291
DOI:10.1016/j.ins.2014.09.025