A triangle area based nearest neighbors approach to intrusion detection

Chih Fong Tsai, Chia Ying Lin

Research output: Contribution to journalArticlepeer-review

176 Scopus citations


Intrusion detection is a necessary step to identify unusual access or attacks to secure internal networks. In general, intrusion detection can be approached by machine learning techniques. In literature, advanced techniques by hybrid learning or ensemble methods have been considered, and related work has shown that they are superior to the models using single machine learning techniques. This paper proposes a hybrid learning model based on the triangle area based nearest neighbors (TANN) in order to detect attacks more effectively. In TANN, the k-means clustering is firstly used to obtain cluster centers corresponding to the attack classes, respectively. Then, the triangle area by two cluster centers with one data from the given dataset is calculated and formed a new feature signature of the data. Finally, the k-NN classifier is used to classify similar attacks based on the new feature represented by triangle areas. By using KDD-Cup '99 as the simulation dataset, the experimental results show that TANN can effectively detect intrusion attacks and provide higher accuracy and detection rates, and the lower false alarm rate than three baseline models based on support vector machines, k-NN, and the hybrid centroid-based classification model by combining k-means and k-NN.

Original languageEnglish
Pages (from-to)222-229
Number of pages8
JournalPattern Recognition
Issue number1
StatePublished - Jan 2010


  • Intrusion detection
  • k-means
  • k-nearest neighbors
  • Machine learning
  • Support vector machines
  • Triangle area


Dive into the research topics of 'A triangle area based nearest neighbors approach to intrusion detection'. Together they form a unique fingerprint.

Cite this