Clustering-Based Intrusion Detection System for High Volume and High Velocity Packet Streams

Any intrusion detection system's efficacy is determined by how quickly it can identify fresh threats and stop subsequent assaults. This requires employing highly efficient machine learning techniques, including clustering algorithms that can distinguish between normal and abnormal network data. This research proposes an IDS based on machine learning utilizing clustering, marking an initial step in this direction. By comparing various clustering techniques using network packet traces, the authors provide data for evaluating these algorithms. The article also outlines a work-in-progress IDS suitable for environments with high traffic volumes, blurred enterprise boundaries, and a high risk of malicious attacks.