A nature-inspired approach to speed up optimum-path forest clustering and its application to intrusion detection in computer networks

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)

Conselho Nacional de Desenvolvimento Científico e Tecnológico (CNPq)

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES)

Processo FAPESP: 2009/16206-1

Processo FAPESP: 2010/02045-3

Processo FAPESP: 2011/14058-5

Processo FAPESP: 2011/14094-1

Processo FAPESP: 2013/20387-7

We propose a nature-inspired approach to estimate the probability density function (pdf) used for data clustering based on the optimum-path forest algorithm (OPFC). OPFC interprets a dataset as a graph, whose nodes are the samples and each sample is connected to its k-nearest neighbors in a given feature space (a k-nn graph). The nodes of the graph are weighted by their pdf values and the pdf is computed based on the distances between the samples and their k-nearest neighbors. Once the k-nn graph is defined, OPFC finds one sample (root) at each maximum of the pdf and propagates one optimum-path tree (cluster) from each root to the remaining samples of its dome. Clustering effectiveness will depend on the pdf estimation, and the proposed approach efficiently computes the best value of k for a given application. We validate our approach in the context of intrusion detection in computer networks. First, we compare OPFC with data clustering based on k-means, and self-organization maps. Second, we evaluate several metaheuristic techniques to find the best value of k. (C) 2014 Elsevier Inc. All rights reserved.