A COST SENSITIVE LEARNING METHOD TO TUNE THE NEAREST NEIGHBOUR FOR INTRUSION DETECTION

In this paper, a novel cost-sensitive learning algorithm is proposed to improve the performance of the nearest neighbor for intrusion detection. The goal of the learning algorithm is to minimize the total cost in leave-one-out classification of the given training set. This is important since intrusion detection is a problem in which the costs of different misclassifications are not the same. To optimize the nearest neighbor for intrusion detection, the distance function is defined in a parametric form. The free parameters of the distance function (i.e., the weights of features and instances) are adjusted by our proposed feature-weighting and instance-weighting algorithms. The proposed feature-weighting algorithm can be viewed as general purpose wrapper approach for feature weighting. The instance-weighting algorithm is designed to remove noisy and redundant training instances from the training set. This, in turn improves the speed and performance of the nearest neighbor in the generalization phase, which is quite important in real-time applications such as intrusion detection. Using the KDD99 dataset, we show that the scheme is quite effective in designing a cost-sensitive nearest neighbor for intrusion detection.