A COST SENSITIVE LEARNING METHOD TO TUNE THE NEAREST NEIGHBOUR FOR INTRUSION DETECTION

Abstract– In this paper, a novel cost-sensitive learning algorithm is proposed to improve the
performance of the nearest neighbor for intrusion detection. The goal of the learning algorithm is
to minimize the total cost in leave-one-out classification of the given training set. This is important
since intrusion detection is a problem in which the costs of different misclassifications are not the
same. To optimize the nearest neighbor for intrusion detection, the distance function is defined in a
parametric form. The free parameters of the distance function (i.e., the weights of features and
instances) are adjusted by our proposed feature-weighting and instance-weighting algorithms. The
proposed feature-weighting algorithm can be viewed as general purpose wrapper approach for
feature weighting. The instance-weighting algorithm is designed to remove noisy and redundant
training instances from the training set. This, in turn improves the speed and performance of the
nearest neighbor in the generalization phase, which is quite important in real-time applications
such as intrusion detection. Using the KDD99 dataset, we show that the scheme is quite effective
in designing a cost-sensitive nearest neighbor for intrusion detection.