Parallel KNN and Neighborhood Classification Implementations on GPU for Network Intrusion Detection

Abstract

With a rapid growth of Internet community making a practical usage of numbers of application used in many areas, i.e., research, commercial, industry, and even in military, there are millions of reports on attacks and attempts to invade the system online; and that phenomenon has led the essential of intrusion detection system (IDS). Data mining is one of the promising approaches to deal with large scale dataset including attack detection and recognition based on attack traces as an example from KDD CUP 1999. However, one of its key limitations is the computational complexity, and thus, this research investigates the possibility to integrate parallel processing to enhance the detection speed-up implemented on NVIDIA CUDA GPU. Several proposals have focused on kNearest Neighbour (KNN) as one of the promising approaches due to its key advantage of simplicity and high precision; however, in addition to KNN evaluation, this research also proposes the integration of a simplified neighborhood classification (Neighborhood) using the percentage instead of group ranking resulting in higher accuracy gain with insignificantly increase of computational complexity trade-off.