Comparative analysis of K-medoids clustering and frequent episode mining for intrusion detection

In cyber security, intrusion detection is one significant area of research. Intrusion detection systems (IDS) are aimed to identify the violations or other malicious activities happening in a system. Such systems must be accurate and reliable such that potential threats are captured. Machine learning provides a handful of supervised and unsupervised algorithms and techniques in identifying and classifying the attacks. This paper implements the K-Medoids clustering and frequent episode mining (FEM) algorithms, the unsupervised technique, for intrusion detection on the KDD Cup 1999 dataset [ 12 ]. The K-Medoids algorithm, an improvement on K-Means clustering, enhances outlier robustness, whereas FEM finds interesting patterns of sequential actions characteristic of intrusions. Feature selection is performed by combining mutual information with the Random Forest classifier. Experimental results demonstrate that FEM has a better classification accuracy of 94.3%, as opposed to 87.6% for K-Medoids. In addition, it exhibits better anomaly detection performance with reduced false-positive rates. However, K-Medoids are computationally more efficient and scalable for unsupervised environments. In general, FEM is more effective for temporal intrusion detection, whereas K-Medoids provides a lightweight solution for real-time anomaly clustering.