Abstract: In consideration of the shortcomings of traditional K-means clustering algorithm, such as poor global search ability and artificial initial cluster number, an intrusion detection system using adaptive K-means algorithm optimized by novel Cuckoo Search algorithm (NCS-AKM) was proposed. In order to increase the diversity of CS algorithm, a similar differential evolution strategy was introduced to complete the individual variation. The KDD Cup99 dataset was applied to rebuild the training data and the four-phase testing data where a new attack was introduced respectively in third and fourth phase. The experiment indicates that NCS-AKM system is sensitive to new attacks, obtaining satisfied detection performance as well as convincing clustering result, and the overall detection rate of four attacks is as high as 83.4% (range:70.8%~89.9%), while the false positive rate is 6.3% (range: 3.0%~11.5%).

Key words: cuckoo search (CS) algorithm, K-means, intrusion online detection, automatic clusters number, differential evolution