A Light-weighted Network Traffic Intrusion Detection Method Based on Grid-Density Peak Clustering

The malicious traffic generated by attack behaviors shows similarity in character distribution, and specific types of malicious traffic also have differences in spatial distribution due to their formation methods and attack methods. Aiming at these two characteristics, we propose a network traffic intrusion detection method based on grid-density peak clustering(GDPC). It uses grid clustering to form clusters, and then uses the density peak clustering algorithm to distinguish different local densities belong the clusters. We apply the Autoencoder to reduce the dimensionality of the data. After learning and recording the malicious traffic distribution, our saved data only contains less than 500 records of cluster information, which is light-weighted. In the experiment on the CIC-IDS2018 dataset, the classification accuracy of six types of malicious traffic is not less than 95%, and the classification accuracy of unknown malicious traffic has reached 80%. Experiment shows that our proposed method has smaller time complexity than other common cluster algorithms, and our GDPC is not only effective in the known malicious traffic but also has better identification ability for unknown malicious traffic, which is a feasible intrusion detection method.