An Adaptive Anomaly Detection Algorithm Based on CFSFDP

CFSFDP (Clustering by fast search and find of density peak) is a simple and crisp density clustering algorithm. It does not only have the advantages of density clustering algorithm, but also can find the peak of cluster automatically. However, the lack of adaptability makes it difficult to apply in intrusion detection. The new input cannot be updated in time to the existing profiles, and rebuilding profiles would waste a lot of time and computation. Therefore, an adaptive anomaly detection algorithm based on CFSFDP is proposed in this paper. By analyzing the influence of new input on center, edge and discrete points, the adaptive problem mainly focuses on processing with the generation of new cluster by new input. The improved algorithm can integrate new input into the existing clustering without changing the original profiles. Meanwhile, the improved algorithm takes the advantage of multi-core parallel computing to deal with redundant computing. A large number of experiments on intrusion detection on Android platform and KDDCUP 1999 show that the improved algorithm can update the profiles adaptively without affecting the original detection performance. Compared with the other classical algorithms, the improved algorithm based on CFSFDP has the good basic performance and more room of improvement.