Performance Analysis Between EOTI-K-Means++, EOTI, and KNN for Brute Force Detection System

An Intrusion Detection System (IDS) is software or hardware that monitors system or network activities for policy violations or malicious activity and sends reports to the management system. Clustering algorithms using instance-based learning, such as quick, efficient optimal triangle-inequality-based EOTI can be used to discover anomalous traffic patterns. Instead of using the standard K-Means technique in the EOTI algorithm, this study uses the K-Means++ approach for clustering as EOTI-K-Means++. The K-Means++ tries to solve the K-Means algorithm's disadvantages, namely its high memory usage. For further analysis, we use k-nearest neighbors (KNN) in this problem. The K-Means++ ensures a more intelligent introduction of centroids and enhances the clustering's nature. Both basic EOTI's accuracy and EOTI-K-Means++ are slightly lower than KNN for high precision, recall, and F1-score. But they yield the fastest time and a lowest memory consumption during training and prediction. EOTI K-Means++ outperforms in terms of execution time for training of 1267.77s, but predicting process is longer than EOTI of 149987.26s.