A Median Nearest Neighbors LDA for Anomaly Network Detection

摘要

The Linear Discriminant Analysis (LDA) is a powerful linear feature reduction technique. It often produces satisfactory results under two conditions. The first one requires that the global data structure and the local data structure must be coherent. The second concerns data classes distribution nature. It should be a Gaussian distribution. Nevertheless, in pattern recognition problems, especially network anomalies detection, these conditions are not always fulfilled. In this paper, we propose an improved LDA algorithm, the median nearest neighbors LDA (median NN-LDA), which performs well without satisfying the above two conditions. Our approach can effectively get the local structure of data by working with samples that are near to the median of every data class. The further samples will be essential for preserving the global structure of every class. Extensive experiments on two well known datasets namely KDDcup99 and NSL-KDD show that the proposed approach can achieve a promising attack identification accuracy.